01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe
Size 4.5MB
Sample260817-m36keaah72
SHA256 01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112
MD5 3d185ec5ec170b7ca283c1151331fd27
SHA1 920f20c4391b0f0cf64174bd7c3e09feda348758
SHA512 e0f1c9050a77e2c8cb1cabdc57a4837032899d8b9e6aa70e5d5d69ab6797a357799df6cdf78b5d946932e0642760d8cf1b9f6074e73e1533630b7c236d941c04
SSDEEP 98304:RIpcW+i25z7tV4/qJwA8X6HVkM3gsj9fNwxf8buvtjMzUnXCeLtZq:GmWP2v4/jAC6nNOFj7nSQq
TLSH
T1AE261213B713F5B2C1E11679C1492B37AAE89E0156B0F43FBA936E51FCE18194EA5B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1476	Proxy64.sys

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Proxy64.sys	01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2512	4804	01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe	89

C:\Users\Admin\AppData\Local\Temp\01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe
"C:\Users\Admin\AppData\Local\Temp\01907c6bc010f06bfac37060a704d9109e967791038a90230026b76bf1939112.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2512

C:\Windows\SysWOW64\Proxy64.sys
C:\Windows\SysWOW64\Proxy64.sys
1⤵
- Executes dropped EXE
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Proxy64.sys

Path C:\Windows\SysWOW64\Proxy64.sys
Size 107KB
SHA256 33e28b22a79ddd58e91811afd44a8625ecb60f74172d3f90661ad5330f20d67a
MD5 4ecbe3bc1fab03432809a7f5c71fb651
SHA1 5612a03324f38bbd620143a8dbb7ac8bd2fc30cb
SHA512 3c3d3effaf405b347062e5d4c011bff1738581c501c64aba35060bcfc8bef163ffb0a8ab67f311affa02b4cb513c80998e5d24f3ba9f9c6fdee214689f705c94
SSDEEP 1536:W6WP4LzaCttxq6yjZ8f41XrbFKXqW0k54HDCbE3xurUfQ38WMnYa8:XM4LmCtzFyjZf17HkcO3PMnY/
TLSH
T1F9B37A6657F454C6EA6AD278C6B2C927EF71B4406F2157DF036089414F73BE2AE38382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-14-0x00007FF6688C0000-0x00007FF6688DA000-memory.dmp

Download

memory/4804-0-0x0000000010000000-0x000000001075F000-memory.dmp

Download

memory/4804-7-0x0000000010000000-0x000000001075F000-memory.dmp

Download

memory/4804-12-0x0000000010000000-0x000000001075F000-memory.dmp

Download

memory/4804-15-0x0000000010000000-0x000000001075F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads