034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe
Size 16KB
Sample260910-3xspcsxejb
SHA256 034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a
MD5 4f41ccd2f2d6a9778e9cb4461e2bcb40
SHA1 87fdda49ad0b7eb236034d5a0a8eae526853f24a
SHA512 41c71604a7ff4be1b7b7e367825a0e0ae3b8cbd83cc12d7be284b5a57f05a890d674e5e72fcd3b9f196baab21692b21b459c4be494a58d98e2d5616a22347e8e
SSDEEP 384:ata/c8fmR1nBJo782lvZwI9BaikOkU59LdK8H1Sqt86qodty3:W8fmbPo9M859LdKUSqtRdE3
TLSH
T10B722A0AB3FCC608F1FE8F752E7687004375FA47AE22D64E08D9549D5D317588E64BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution lateral_movement persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
5588	net.exe
700	net1.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5640	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5356	netsh.exe
868	netsh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5640	powershell.exe
2184	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
17	api.ipify.org
18	api.ipify.org
19	ip-api.com

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
5964	net.exe
2040	net1.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5640	powershell.exe
2184	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5640	powershell.exe
5640	powershell.exe
2184	powershell.exe
2184	powershell.exe
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe
Token: SeDebugPrivilege	5640	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5640	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	84
PID 4716 wrote to memory of 5964	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	95
PID 5964 wrote to memory of 2040	5964	net.exe	97
PID 4716 wrote to memory of 5588	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	108
PID 5588 wrote to memory of 700	5588	net.exe	110
PID 4716 wrote to memory of 5356	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	111
PID 4716 wrote to memory of 868	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	114
PID 4716 wrote to memory of 5688	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	116
PID 5688 wrote to memory of 2432	5688	net.exe	118
PID 4716 wrote to memory of 5872	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	119
PID 5872 wrote to memory of 748	5872	net.exe	121
PID 4716 wrote to memory of 2184	4716	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	122

C:\Users\Admin\AppData\Local\Temp\034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe
"C:\Users\Admin\AppData\Local\Temp\034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue" -ExecutionPolicy Bypass
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5640
- C:\Windows\SYSTEM32\net.exe
  "net" user WindowsUpdateSvc MySecurePass123! /add
  2⤵
  - Creates a new local user account
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdateSvc MySecurePass123! /add
    3⤵
    - Creates a new local user account
    PID:2040
- C:\Windows\SYSTEM32\net.exe
  "net" localgroup "Remote Desktop Users" WindowsUpdateSvc /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Remote Desktop Users" WindowsUpdateSvc /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:700
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group="Remote Desktop" new enable=Yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5356
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group="Удаленный рабочий стол" new enable=Yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:868
- C:\Windows\SYSTEM32\net.exe
  "net" localgroup "Administrators" WindowsUpdateSvc /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Administrators" WindowsUpdateSvc /add
    3⤵
    PID:2432
- C:\Windows\SYSTEM32\net.exe
  "net" localgroup "Administrators"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Administrators"
    3⤵
    PID:748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $false -ErrorAction SilentlyContinue" -ExecutionPolicy Bypass
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 bcf3ba98af6ee96a3eba9bbc6bdb2ae36b883f5f1e9cdad2974cbbcb9c102237
MD5 354ebb8d437ee057dacfef36baced4e9
SHA1 30460dbe64847ebb524d7d1fd5b9bf8a851a7626
SHA512 1f2cb272ad33df6e34949ac4d60ec0702316d9e21992be52cd9c6abd846472e7c868a8e96b5922b016e7952e460671e5768d007e28d84940a1b956eef4705b53
TLSH
T16D112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wi35gy3y.3ci.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wi35gy3y.3ci.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4716-0-0x0000000000960000-0x000000000096A000-memory.dmp

Download

memory/4716-1-0x000000001B610000-0x000000001B620000-memory.dmp

Download

memory/4716-15-0x000000001B610000-0x000000001B620000-memory.dmp

Download

memory/5640-3-0x000001ADD60E0000-0x000001ADD60F0000-memory.dmp

Download

memory/5640-2-0x000001ADD60E0000-0x000001ADD60F0000-memory.dmp

Download

memory/5640-4-0x000001ADD5F90000-0x000001ADD5FB2000-memory.dmp

Download

memory/5640-14-0x000001ADD8460000-0x000001ADD85CA000-memory.dmp

Download