Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 03:32
General
- Target Autoruns.exe
- Size 11.4MB
- Sample261007-d32f1scz3p
- SHA256 66be72c5803412423e462926764ba9dc73a26a37aeb3cf3670e99ca8be34df9a
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 2 IoCs
- UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Autoruns.exe"C:\Users\Admin\AppData\Local\Temp\Autoruns.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c netsh advfirewall firewall add rule name="Autoruns" description="自动化游戏" dir=in program="C:\Users\Admin\AppData\Local\Temp\Autoruns.exe" action=allow2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Autoruns" description="自动化游戏" dir=in program="C:\Users\Admin\AppData\Local\Temp\Autoruns.exe" action=allow3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c netsh advfirewall firewall Add rule name="Autoruns" description="自动化游戏" dir=out program="C:\Users\Admin\AppData\Local\Temp\Autoruns.exe" action=allow2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall Add rule name="Autoruns" description="自动化游戏" dir=out program="C:\Users\Admin\AppData\Local\Temp\Autoruns.exe" action=allow3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/8-0-0x0000000000400000-0x0000000000FEC000-memory.dmp
memory/8-24-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-28-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-45-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-42-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-40-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-38-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-36-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-34-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-32-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-30-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-26-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-22-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-20-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-18-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-14-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-3-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-2-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-44-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-1-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-16-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-12-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-10-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-8-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-6-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-4-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-52-0x0000000010000000-0x000000001003E000-memory.dmp
memory/8-53-0x0000000000400000-0x0000000000FEC000-memory.dmp