Overview
overview
8Static
static
3alzaabitwe...ED.rar
windows10-2004-x64
1alzaabitwe...ED.rar
windows11-ltsc_2024-x64
1loader.exe
windows10-2004-x64
3loader.exe
windows11-ltsc_2024-x64
3patch/readme.md
windows10-2004-x64
3patch/readme.md
windows11-ltsc_2024-x64
3patch/remove.bat
windows10-2004-x64
8patch/remove.bat
windows11-ltsc_2024-x64
8patch/run.bat
windows10-2004-x64
8patch/run.bat
windows11-ltsc_2024-x64
8patch/server.js
windows10-2004-x64
3patch/server.js
windows11-ltsc_2024-x64
3حل مش�...خ.bat
windows10-2004-x64
8حل مش�...خ.bat
windows11-ltsc_2024-x64
8حل مش�...ث.bat
windows10-2004-x64
7حل مش�...ث.bat
windows11-ltsc_2024-x64
4حل مش�...ز.bat
windows10-2004-x64
6حل مش�...ز.bat
windows11-ltsc_2024-x64
6حل مش�...ت.bat
windows10-2004-x64
6حل مش�...ت.bat
windows11-ltsc_2024-x64
6حل مش�...ب.bat
windows10-2004-x64
8حل مش�...ب.bat
windows11-ltsc_2024-x64
8حل مش�...RU.bat
windows10-2004-x64
6حل مش�...RU.bat
windows11-ltsc_2024-x64
6Analysis
- max time kernel
298s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
alzaabitweaksPATCHED.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
alzaabitweaksPATCHED.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
patch/readme.md
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
patch/readme.md
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
patch/remove.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
patch/remove.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
patch/run.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
patch/run.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
patch/server.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
patch/server.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
حل مشاكل/النسخ.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
حل مشاكل/النسخ.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
حل مشاكل/بلوتوث.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
حل مشاكل/بلوتوث.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
حل مشاكل/حل مشكله ابيك قيمز.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
حل مشاكل/حل مشكله ابيك قيمز.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
حل مشاكل/حل مشكله الواي فاي والنت.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
حل مشاكل/حل مشكله الواي فاي والنت.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
حل مشاكل/حل مشكله سطح مكتب.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
حل مشاكل/حل مشكله سطح مكتب.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
حل مشاكل/حل مشكله شاشه CRU.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
حل مشاكل/حل مشكله شاشه CRU.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target حل مشاكل/حل مشكله الواي فاي والنت.bat
- Size 2KB
- Sample260824-p5dnhsde33
- SHA256 ba566e050bb37e329040de4156b1e179ef0ef2534ca4508e31791603cd28c29f
- MD5 465c1637f74c4c8cbc40776af0bbd9b4
- SHA1 cd46cea010ad0ce557056de50d09e3a030f6c8fb
- SHA512 86d377cb5435e63a27f2dc76bb2450fbcb3cac307ad3118b2d56358523390301b0ea214d84a3da8b4ad76163aaeab6c00f911a4e31486dbf3711d739ca1d3aa5
- TLSH T1EF41E0133D68BC8D06C2CD42DAE76321FFA41ADB11863ED9D0E611E92122BD3D36D90D
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
-
pid Process 4988 powershell.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 3740 powershell.exe 4988 powershell.exe - Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2508 sc.exe 4492 sc.exe 2600 sc.exe 816 sc.exe 3784 sc.exe 4844 sc.exe 3860 sc.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1952 cmd.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1140 ipconfig.exe 1112 ipconfig.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4988 powershell.exe 4988 powershell.exe 3740 powershell.exe 3740 powershell.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4988 powershell.exe Token: SeIncreaseQuotaPrivilege 4988 powershell.exe Token: SeSecurityPrivilege 4988 powershell.exe Token: SeTakeOwnershipPrivilege 4988 powershell.exe Token: SeLoadDriverPrivilege 4988 powershell.exe Token: SeSystemProfilePrivilege 4988 powershell.exe Token: SeSystemtimePrivilege 4988 powershell.exe Token: SeProfSingleProcessPrivilege 4988 powershell.exe Token: SeIncBasePriorityPrivilege 4988 powershell.exe Token: SeCreatePagefilePrivilege 4988 powershell.exe Token: SeBackupPrivilege 4988 powershell.exe Token: SeRestorePrivilege 4988 powershell.exe Token: SeShutdownPrivilege 4988 powershell.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeSystemEnvironmentPrivilege 4988 powershell.exe Token: SeRemoteShutdownPrivilege 4988 powershell.exe Token: SeUndockPrivilege 4988 powershell.exe Token: SeManageVolumePrivilege 4988 powershell.exe Token: 33 4988 powershell.exe Token: 34 4988 powershell.exe Token: 35 4988 powershell.exe Token: 36 4988 powershell.exe Token: SeIncreaseQuotaPrivilege 4988 powershell.exe Token: SeSecurityPrivilege 4988 powershell.exe Token: SeTakeOwnershipPrivilege 4988 powershell.exe Token: SeLoadDriverPrivilege 4988 powershell.exe Token: SeSystemProfilePrivilege 4988 powershell.exe Token: SeSystemtimePrivilege 4988 powershell.exe Token: SeProfSingleProcessPrivilege 4988 powershell.exe Token: SeIncBasePriorityPrivilege 4988 powershell.exe Token: SeCreatePagefilePrivilege 4988 powershell.exe Token: SeBackupPrivilege 4988 powershell.exe Token: SeRestorePrivilege 4988 powershell.exe Token: SeShutdownPrivilege 4988 powershell.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeSystemEnvironmentPrivilege 4988 powershell.exe Token: SeRemoteShutdownPrivilege 4988 powershell.exe Token: SeUndockPrivilege 4988 powershell.exe Token: SeManageVolumePrivilege 4988 powershell.exe Token: 33 4988 powershell.exe Token: 34 4988 powershell.exe Token: 35 4988 powershell.exe Token: 36 4988 powershell.exe Token: SeDebugPrivilege 3740 powershell.exe Token: SeIncreaseQuotaPrivilege 3740 powershell.exe Token: SeSecurityPrivilege 3740 powershell.exe Token: SeTakeOwnershipPrivilege 3740 powershell.exe Token: SeLoadDriverPrivilege 3740 powershell.exe Token: SeSystemProfilePrivilege 3740 powershell.exe Token: SeSystemtimePrivilege 3740 powershell.exe Token: SeProfSingleProcessPrivilege 3740 powershell.exe Token: SeIncBasePriorityPrivilege 3740 powershell.exe Token: SeCreatePagefilePrivilege 3740 powershell.exe Token: SeBackupPrivilege 3740 powershell.exe Token: SeRestorePrivilege 3740 powershell.exe Token: SeShutdownPrivilege 3740 powershell.exe Token: SeDebugPrivilege 3740 powershell.exe Token: SeSystemEnvironmentPrivilege 3740 powershell.exe Token: SeRemoteShutdownPrivilege 3740 powershell.exe Token: SeUndockPrivilege 3740 powershell.exe Token: SeManageVolumePrivilege 3740 powershell.exe Token: 33 3740 powershell.exe Token: 34 3740 powershell.exe Token: 35 3740 powershell.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1952 wrote to memory of 4708 1952 cmd.exe 87 PID 4708 wrote to memory of 4264 4708 net.exe 88 PID 1952 wrote to memory of 4988 1952 cmd.exe 89 PID 1952 wrote to memory of 4912 1952 cmd.exe 94 PID 1952 wrote to memory of 2508 1952 cmd.exe 95 PID 1952 wrote to memory of 4492 1952 cmd.exe 96 PID 1952 wrote to memory of 2600 1952 cmd.exe 97 PID 1952 wrote to memory of 816 1952 cmd.exe 98 PID 1952 wrote to memory of 3784 1952 cmd.exe 99 PID 1952 wrote to memory of 4844 1952 cmd.exe 100 PID 1952 wrote to memory of 3860 1952 cmd.exe 101 PID 1952 wrote to memory of 2816 1952 cmd.exe 102 PID 2816 wrote to memory of 228 2816 net.exe 103 PID 1952 wrote to memory of 2736 1952 cmd.exe 106 PID 2736 wrote to memory of 1404 2736 net.exe 107 PID 1952 wrote to memory of 2756 1952 cmd.exe 108 PID 2756 wrote to memory of 2752 2756 net.exe 109 PID 1952 wrote to memory of 1752 1952 cmd.exe 110 PID 1752 wrote to memory of 2936 1752 net.exe 111 PID 1952 wrote to memory of 4252 1952 cmd.exe 112 PID 4252 wrote to memory of 1368 4252 net.exe 113 PID 1952 wrote to memory of 1196 1952 cmd.exe 114 PID 1196 wrote to memory of 4720 1196 net.exe 115 PID 1952 wrote to memory of 1112 1952 cmd.exe 117 PID 1952 wrote to memory of 1140 1952 cmd.exe 118 PID 1952 wrote to memory of 2176 1952 cmd.exe 119 PID 1952 wrote to memory of 4576 1952 cmd.exe 121 PID 1952 wrote to memory of 3740 1952 cmd.exe 122
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\حل مشاكل\حل مشكله الواي فاي والنت.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:4264
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "Get-NetAdapter | ForEach-Object { Set-DnsClientServerAddress -InterfaceAlias $_.Name -ResetServerAddresses -ErrorAction SilentlyContinue }"2⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d 0 /f2⤵PID:4912
-
-
C:\Windows\system32\sc.exesc config WlanSvc start= auto2⤵
- Launches sc.exe
PID:2508
-
-
C:\Windows\system32\sc.exesc config Dhcp start= auto2⤵
- Launches sc.exe
PID:4492
-
-
C:\Windows\system32\sc.exesc config Dnscache start= auto2⤵
- Launches sc.exe
PID:2600
-
-
C:\Windows\system32\sc.exesc config nsi start= auto2⤵
- Launches sc.exe
PID:816
-
-
C:\Windows\system32\sc.exesc config npsi start= auto2⤵
- Launches sc.exe
PID:3784
-
-
C:\Windows\system32\sc.exesc config NlaSvc start= auto2⤵
- Launches sc.exe
PID:4844
-
-
C:\Windows\system32\sc.exesc config netprofm start= auto2⤵
- Launches sc.exe
PID:3860
-
-
C:\Windows\system32\net.exenet start WlanSvc2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WlanSvc3⤵PID:228
-
-
-
C:\Windows\system32\net.exenet start Dhcp2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start Dhcp3⤵PID:1404
-
-
-
C:\Windows\system32\net.exenet start Dnscache2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start Dnscache3⤵PID:2752
-
-
-
C:\Windows\system32\net.exenet start nsi2⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start nsi3⤵PID:2936
-
-
-
C:\Windows\system32\net.exenet start NlaSvc2⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start NlaSvc3⤵PID:1368
-
-
-
C:\Windows\system32\net.exenet start netprofm2⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start netprofm3⤵PID:4720
-
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:1112
-
-
C:\Windows\system32\ipconfig.exeipconfig /registerdns2⤵
- Gathers network information
PID:1140
-
-
C:\Windows\system32\netsh.exenetsh int ip reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2176
-
-
C:\Windows\system32\netsh.exenetsh winsock reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class 'Net' -ErrorAction SilentlyContinue | Where-Object { $_.FriendlyName -like '*Wi-Fi*' -or $_.FriendlyName -like '*Wireless*' -or $_.FriendlyName -like '*WLAN*' } | Enable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:4024
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 70d66b78d8176bbd71e89c07e16e9551b8ef848a0157216dc94ceaab66ef2930
- MD5 84ad5ddb8558903f27ae91fe0564e7e1
- SHA1 834133d4eeb2f4b2d793aa7994c57b015ab03d8a
- SHA512 9c564f1ad5cc23a0ad1a0fb1b909f009e41b0ff3e7cdc3f7736622224cd8a49d0c8ad983ebaf3e745bfaf862dc0e7af6820082262a43c413dc7ef3d5af58f864
- TLSH T1E251EF313275F0D4C9667F07292819D463BF4386EA94AF5CB658621ED93641BCF222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 15ae0a549e5cb68ba64c611270ea27b63aec740fd3bf7b5ea57db3549793ad47
- MD5 c3e3dd6df2610d1992cfbddcf2a1ff04
- SHA1 5b3b70aab424d0cf6b577721a767cf0c9665d802
- SHA512 00e48b9444d1a33c9c6fb5f6fbf418ab9d3e81fe1c165d1b6ab81a8011d9cca03248690979e9475635ef3edd7e16d8f00fc2199e28b52dd2bd614fa94d805704
- TLSH T1B3215637B3DD8920DCDA153A209C9C5172B696CB81DFCF9B6FC0D22195BFA98CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_12znz1ya.jjg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH