230f5512ac0fa477b75ba3f2ef091e71192ab4db89b5dc7cb73dcaff932237eb

Analysis

user interaction
yes
max time kernel
129s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run_freakspan.bat
Size 112KB
Sample260922-m2cwpscf39
SHA256 230f5512ac0fa477b75ba3f2ef091e71192ab4db89b5dc7cb73dcaff932237eb
MD5 345ca91830ccc48b3a99afe98044a898
SHA1 e61e697687cf448174fbc3472014e63b3973dae6
SHA512 22fa0b2600ce725b67eb6a4bf755740364051769650f2502d7f3f6118c8f69d98b1235dec8dfd72764cb5708f4e63a2dd625b80fd3d565b89414f084ef27661d
SSDEEP 1536:9ZwYz0Nn6NXNhwNqu4oD+1YsNUcaJYZHlUcjMH6gf7pYu3CEZ/I+MA21X3wOPImO:s4FJHKEMpf7pYu35/f6X3wOPILAho
TLSH
T194B3D657DE573DA5A7A852872DCDB9C21DEC339B30E204ED095BDA9893CC9E820F109D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3172	netsh.exe
3700	netsh.exe
1276	netsh.exe
5108	netsh.exe
2596	netsh.exe
1856	netsh.exe
3640	netsh.exe
4704	netsh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1552	powershell.exe
1328	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2208	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4576	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1552	powershell.exe
1552	powershell.exe
2208	powershell.exe
2208	powershell.exe
1328	powershell.exe
1328	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4920	4576	cmd.exe	92
PID 4920 wrote to memory of 1408	4920	net.exe	93
PID 4576 wrote to memory of 1552	4576	cmd.exe	94
PID 4576 wrote to memory of 2208	4576	cmd.exe	95
PID 4576 wrote to memory of 1328	4576	cmd.exe	96
PID 4576 wrote to memory of 4704	4576	cmd.exe	97
PID 4576 wrote to memory of 3172	4576	cmd.exe	98
PID 4576 wrote to memory of 3700	4576	cmd.exe	101
PID 4576 wrote to memory of 1276	4576	cmd.exe	102
PID 4576 wrote to memory of 5108	4576	cmd.exe	104
PID 4576 wrote to memory of 2596	4576	cmd.exe	106
PID 4576 wrote to memory of 1856	4576	cmd.exe	107
PID 4576 wrote to memory of 3640	4576	cmd.exe	108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run_freakspan.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$bat='C:\Users\Admin\AppData\Local\Temp\run_freakspan.bat'; $lines=Get-Content -LiteralPath $bat; $s=[Array]::IndexOf($lines,'::FREAKSPAN_BEGIN')+1; $e=[Array]::IndexOf($lines,'::FREAKSPAN_END'); $b64=($lines[$s..($e-1)] -join ''); [IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Roaming\FreakSpan\file.py',[Convert]::FromBase64String($b64))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Unblock-File -LiteralPath 'C:\Users\Admin\AppData\Roaming\FreakSpan\file.py' -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Write-Host 'Download successful' -ForegroundColor Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name="FreakSpan Main TCP"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4704
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="FreakSpan Main TCP" dir=in action=allow protocol=TCP localport=45917
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3172
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name="FreakSpan Secondary TCP"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3700
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="FreakSpan Secondary TCP" dir=in action=allow protocol=TCP localport=45918
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1276
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name="FreakSpan Discovery UDP"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5108
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="FreakSpan Discovery UDP" dir=in action=allow protocol=UDP localport=45919
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2596
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name="FreakSpan Outbound HTTPS"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1856
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="FreakSpan Outbound HTTPS" dir=out action=allow protocol=TCP remoteport=443
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8720d391596c5749a0f31c8d2d5e307b484372b385ecabc6dc0c36061460395c
MD5 07134c034e74b5e07645b08ad5a2132e
SHA1 9c7d55be64b7ebe0b103563296e80f8260360d75
SHA512 a4395063df006a7ccf2710df587ad2d454b9b4aad4286a922600793acec18f44ea6e0084f1dab0d8bbf3a18b63a009ef6072acc5b91bf87f3943e0eca8d768f1
TLSH
T1FB117623F3DC8A21CC96163A509D9C2172B687DB819EDF9F7BC0D205A5BF588CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
MD5 a5c074e56305e761d7cbc42993300e1c
SHA1 39b2e23ba5c56b4f332b3607df056d8df23555bf
SHA512 c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
TLSH
T1FD117637B39C8A21CC96153A409DAD1172B683C781AEDF9F6FC0D215A0BF985CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yp5iq3er.m5l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yp5iq3er.m5l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1552-0-0x0000026470A90000-0x0000026470AA0000-memory.dmp

Download

memory/1552-1-0x0000026470A90000-0x0000026470AA0000-memory.dmp

Download

memory/1552-9-0x0000026470CD0000-0x0000026470CF2000-memory.dmp

Download

memory/2208-15-0x00000155E4CF0000-0x00000155E4D00000-memory.dmp

Download

memory/2208-14-0x00000155E4CF0000-0x00000155E4D00000-memory.dmp

Download