ba566e050bb37e329040de4156b1e179ef0ef2534ca4508e31791603cd28c29f

Analysis

max time kernel
298s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
حل مشاكل/حل مشكله الواي فاي والنت.bat
Size 2KB
Sample260824-p5dnhsde33
SHA256 ba566e050bb37e329040de4156b1e179ef0ef2534ca4508e31791603cd28c29f
MD5 465c1637f74c4c8cbc40776af0bbd9b4
SHA1 cd46cea010ad0ce557056de50d09e3a030f6c8fb
SHA512 86d377cb5435e63a27f2dc76bb2450fbcb3cac307ad3118b2d56358523390301b0ea214d84a3da8b4ad76163aaeab6c00f911a4e31486dbf3711d739ca1d3aa5
TLSH
T1EF41E0133D68BC8D06C2CD42DAE76321FFA41ADB11863ED9D0E611E92122BD3D36D90D
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6192	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6192	powershell.exe
6252	powershell.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4300	sc.exe
5524	sc.exe
5116	sc.exe
560	sc.exe
7068	sc.exe
3480	sc.exe
3888	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5796	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6456	ipconfig.exe
7044	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
6192	powershell.exe
6192	powershell.exe
6252	powershell.exe
6252	powershell.exe
6252	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6192	powershell.exe
Token: SeIncreaseQuotaPrivilege	6192	powershell.exe
Token: SeSecurityPrivilege	6192	powershell.exe
Token: SeTakeOwnershipPrivilege	6192	powershell.exe
Token: SeLoadDriverPrivilege	6192	powershell.exe
Token: SeSystemProfilePrivilege	6192	powershell.exe
Token: SeSystemtimePrivilege	6192	powershell.exe
Token: SeProfSingleProcessPrivilege	6192	powershell.exe
Token: SeIncBasePriorityPrivilege	6192	powershell.exe
Token: SeCreatePagefilePrivilege	6192	powershell.exe
Token: SeBackupPrivilege	6192	powershell.exe
Token: SeRestorePrivilege	6192	powershell.exe
Token: SeShutdownPrivilege	6192	powershell.exe
Token: SeDebugPrivilege	6192	powershell.exe
Token: SeSystemEnvironmentPrivilege	6192	powershell.exe
Token: SeRemoteShutdownPrivilege	6192	powershell.exe
Token: SeUndockPrivilege	6192	powershell.exe
Token: SeManageVolumePrivilege	6192	powershell.exe
Token: 33	6192	powershell.exe
Token: 34	6192	powershell.exe
Token: 35	6192	powershell.exe
Token: 36	6192	powershell.exe
Token: SeIncreaseQuotaPrivilege	6192	powershell.exe
Token: SeSecurityPrivilege	6192	powershell.exe
Token: SeTakeOwnershipPrivilege	6192	powershell.exe
Token: SeLoadDriverPrivilege	6192	powershell.exe
Token: SeSystemProfilePrivilege	6192	powershell.exe
Token: SeSystemtimePrivilege	6192	powershell.exe
Token: SeProfSingleProcessPrivilege	6192	powershell.exe
Token: SeIncBasePriorityPrivilege	6192	powershell.exe
Token: SeCreatePagefilePrivilege	6192	powershell.exe
Token: SeBackupPrivilege	6192	powershell.exe
Token: SeRestorePrivilege	6192	powershell.exe
Token: SeShutdownPrivilege	6192	powershell.exe
Token: SeDebugPrivilege	6192	powershell.exe
Token: SeSystemEnvironmentPrivilege	6192	powershell.exe
Token: SeRemoteShutdownPrivilege	6192	powershell.exe
Token: SeUndockPrivilege	6192	powershell.exe
Token: SeManageVolumePrivilege	6192	powershell.exe
Token: 33	6192	powershell.exe
Token: 34	6192	powershell.exe
Token: 35	6192	powershell.exe
Token: 36	6192	powershell.exe
Token: SeDebugPrivilege	6252	powershell.exe
Token: SeIncreaseQuotaPrivilege	6252	powershell.exe
Token: SeSecurityPrivilege	6252	powershell.exe
Token: SeTakeOwnershipPrivilege	6252	powershell.exe
Token: SeLoadDriverPrivilege	6252	powershell.exe
Token: SeSystemProfilePrivilege	6252	powershell.exe
Token: SeSystemtimePrivilege	6252	powershell.exe
Token: SeProfSingleProcessPrivilege	6252	powershell.exe
Token: SeIncBasePriorityPrivilege	6252	powershell.exe
Token: SeCreatePagefilePrivilege	6252	powershell.exe
Token: SeBackupPrivilege	6252	powershell.exe
Token: SeRestorePrivilege	6252	powershell.exe
Token: SeShutdownPrivilege	6252	powershell.exe
Token: SeDebugPrivilege	6252	powershell.exe
Token: SeSystemEnvironmentPrivilege	6252	powershell.exe
Token: SeRemoteShutdownPrivilege	6252	powershell.exe
Token: SeUndockPrivilege	6252	powershell.exe
Token: SeManageVolumePrivilege	6252	powershell.exe
Token: 33	6252	powershell.exe
Token: 34	6252	powershell.exe
Token: 35	6252	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 7056	5796	cmd.exe	91
PID 7056 wrote to memory of 6072	7056	net.exe	92
PID 5796 wrote to memory of 6192	5796	cmd.exe	93
PID 5796 wrote to memory of 3720	5796	cmd.exe	97
PID 5796 wrote to memory of 5524	5796	cmd.exe	98
PID 5796 wrote to memory of 4300	5796	cmd.exe	99
PID 5796 wrote to memory of 3888	5796	cmd.exe	100
PID 5796 wrote to memory of 3480	5796	cmd.exe	101
PID 5796 wrote to memory of 5116	5796	cmd.exe	102
PID 5796 wrote to memory of 560	5796	cmd.exe	103
PID 5796 wrote to memory of 7068	5796	cmd.exe	104
PID 5796 wrote to memory of 4408	5796	cmd.exe	105
PID 4408 wrote to memory of 2776	4408	net.exe	106
PID 5796 wrote to memory of 5068	5796	cmd.exe	107
PID 5068 wrote to memory of 6036	5068	net.exe	108
PID 5796 wrote to memory of 2860	5796	cmd.exe	109
PID 2860 wrote to memory of 1188	2860	net.exe	110
PID 5796 wrote to memory of 704	5796	cmd.exe	111
PID 704 wrote to memory of 6244	704	net.exe	112
PID 5796 wrote to memory of 3504	5796	cmd.exe	113
PID 3504 wrote to memory of 5716	3504	net.exe	114
PID 5796 wrote to memory of 6460	5796	cmd.exe	116
PID 6460 wrote to memory of 3116	6460	net.exe	117
PID 5796 wrote to memory of 6456	5796	cmd.exe	118
PID 5796 wrote to memory of 7044	5796	cmd.exe	119
PID 5796 wrote to memory of 6636	5796	cmd.exe	120
PID 5796 wrote to memory of 1976	5796	cmd.exe	121
PID 5796 wrote to memory of 6252	5796	cmd.exe	122

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\حل مشاكل\حل مشكله الواي فاي والنت.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Get-NetAdapter | ForEach-Object { Set-DnsClientServerAddress -InterfaceAlias $_.Name -ResetServerAddresses -ErrorAction SilentlyContinue }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6192
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d 0 /f
  2⤵
  PID:3720
- C:\Windows\system32\sc.exe
  sc config WlanSvc start= auto
  2⤵
  - Launches sc.exe
  PID:5524
- C:\Windows\system32\sc.exe
  sc config Dhcp start= auto
  2⤵
  - Launches sc.exe
  PID:4300
- C:\Windows\system32\sc.exe
  sc config Dnscache start= auto
  2⤵
  - Launches sc.exe
  PID:3888
- C:\Windows\system32\sc.exe
  sc config nsi start= auto
  2⤵
  - Launches sc.exe
  PID:3480
- C:\Windows\system32\sc.exe
  sc config npsi start= auto
  2⤵
  - Launches sc.exe
  PID:5116
- C:\Windows\system32\sc.exe
  sc config NlaSvc start= auto
  2⤵
  - Launches sc.exe
  PID:560
- C:\Windows\system32\sc.exe
  sc config netprofm start= auto
  2⤵
  - Launches sc.exe
  PID:7068
- C:\Windows\system32\net.exe
  net start WlanSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start WlanSvc
    3⤵
    PID:2776
- C:\Windows\system32\net.exe
  net start Dhcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start Dhcp
    3⤵
    PID:6036
- C:\Windows\system32\net.exe
  net start Dnscache
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start Dnscache
    3⤵
    PID:1188
- C:\Windows\system32\net.exe
  net start nsi
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start nsi
    3⤵
    PID:6244
- C:\Windows\system32\net.exe
  net start NlaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start NlaSvc
    3⤵
    PID:5716
- C:\Windows\system32\net.exe
  net start netprofm
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6460
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start netprofm
    3⤵
    PID:3116
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:6456
- C:\Windows\system32\ipconfig.exe
  ipconfig /registerdns
  2⤵
  - Gathers network information
  PID:7044
- C:\Windows\system32\netsh.exe
  netsh int ip reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6636
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class 'Net' -ErrorAction SilentlyContinue | Where-Object { $_.FriendlyName -like '*Wi-Fi*' -or $_.FriendlyName -like '*Wireless*' -or $_.FriendlyName -like '*WLAN*' } | Enable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s NlaSvc
1⤵
PID:524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7b14f808aaf719ed63ab1c0a9da9bfc2f7e6d959ae3fa26a05b77a4a933bcd42
MD5 ec9391aa91f4d69bd957519331c88b8f
SHA1 e64297bbdd3793e0ec94a9ad27970af993576dea
SHA512 89955b22aa1bfaeb1a13f712cbe3eb5cfe69fb63be94279a8c02c215f7b68e40d8793f9bb0bb6ea8ed35f686385f63a081a3aa277cecd2b488a47be824b4242c
TLSH
T1B5217933B3CC8615C899413A10CDAC2036B6C7CB40DECFAB7B84E655A53F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fefgrbp2.ej0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fefgrbp2.ej0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6192-18-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-31-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-6-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-7-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-8-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-11-0x000002212A6F0000-0x000002212A70E000-memory.dmp

Download

memory/6192-12-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-13-0x000002212A990000-0x000002212AA42000-memory.dmp

Download

memory/6192-14-0x000002212A6D0000-0x000002212A6DA000-memory.dmp

Download

memory/6192-15-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-16-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-20-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-5-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-0-0x00007FF9348CF000-0x00007FF9348D0000-memory.dmp

Download

memory/6192-17-0x000002212A730000-0x000002212A74E000-memory.dmp

Download

memory/6192-21-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-22-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-23-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-24-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-25-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-26-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-28-0x000002212A720000-0x000002212A73A000-memory.dmp

Download

memory/6192-27-0x000002212A6F0000-0x000002212A700000-memory.dmp

Download

memory/6192-29-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-19-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download

memory/6192-4-0x0000022112200000-0x0000022112222000-memory.dmp

Download

memory/6192-1-0x00007FF934740000-0x00007FF9350E4000-memory.dmp

Download