e8a9cc601499831a4403a657e9abdf9183ecae81dfa2533a64fb22afdba2bbb0

Analysis

max time kernel
1s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
net8.0-windows/Spoof resources/NetFixer.bat
Size 1KB
Sample261018-1eptmsts3j
SHA256 e8a9cc601499831a4403a657e9abdf9183ecae81dfa2533a64fb22afdba2bbb0
MD5 347b92301d09c37047bf6b9252dfeade
SHA1 a824e1fa36c96256fba93e76e36738a30aeecca3
SHA512 2782c58c1ddebc3cb85c8fe843b00b978a9e97f3f390d0774d81d668a5a7ad94f0ebadb9de7e98b4105504c3ac7f50126f7a65fbecded1957bcc3d03fa507a64
TLSH
T16341230258901770C983811C1B9FC980C920B09E669759B9386C729E1FD7FC992FFDDE
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
256	cmd.exe
2560	cmd.exe
2424	cmd.exe
2060	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
716	WMIC.exe
716	WMIC.exe
716	WMIC.exe
716	WMIC.exe
5388	WMIC.exe
5388	WMIC.exe
5388	WMIC.exe
5388	WMIC.exe
716	WMIC.exe
716	WMIC.exe
716	WMIC.exe
716	WMIC.exe
5388	WMIC.exe
5388	WMIC.exe
5388	WMIC.exe
5388	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	716	WMIC.exe
Token: SeSecurityPrivilege	716	WMIC.exe
Token: SeTakeOwnershipPrivilege	716	WMIC.exe
Token: SeLoadDriverPrivilege	716	WMIC.exe
Token: SeSystemProfilePrivilege	716	WMIC.exe
Token: SeSystemtimePrivilege	716	WMIC.exe
Token: SeProfSingleProcessPrivilege	716	WMIC.exe
Token: SeIncBasePriorityPrivilege	716	WMIC.exe
Token: SeCreatePagefilePrivilege	716	WMIC.exe
Token: SeBackupPrivilege	716	WMIC.exe
Token: SeRestorePrivilege	716	WMIC.exe
Token: SeShutdownPrivilege	716	WMIC.exe
Token: SeDebugPrivilege	716	WMIC.exe
Token: SeSystemEnvironmentPrivilege	716	WMIC.exe
Token: SeRemoteShutdownPrivilege	716	WMIC.exe
Token: SeUndockPrivilege	716	WMIC.exe
Token: SeManageVolumePrivilege	716	WMIC.exe
Token: 33	716	WMIC.exe
Token: 34	716	WMIC.exe
Token: 35	716	WMIC.exe
Token: 36	716	WMIC.exe
Token: SeIncreaseQuotaPrivilege	716	WMIC.exe
Token: SeSecurityPrivilege	716	WMIC.exe
Token: SeTakeOwnershipPrivilege	716	WMIC.exe
Token: SeLoadDriverPrivilege	716	WMIC.exe
Token: SeSystemProfilePrivilege	716	WMIC.exe
Token: SeSystemtimePrivilege	716	WMIC.exe
Token: SeProfSingleProcessPrivilege	716	WMIC.exe
Token: SeIncBasePriorityPrivilege	716	WMIC.exe
Token: SeCreatePagefilePrivilege	716	WMIC.exe
Token: SeBackupPrivilege	716	WMIC.exe
Token: SeRestorePrivilege	716	WMIC.exe
Token: SeShutdownPrivilege	716	WMIC.exe
Token: SeDebugPrivilege	716	WMIC.exe
Token: SeSystemEnvironmentPrivilege	716	WMIC.exe
Token: SeRemoteShutdownPrivilege	716	WMIC.exe
Token: SeUndockPrivilege	716	WMIC.exe
Token: SeManageVolumePrivilege	716	WMIC.exe
Token: 33	716	WMIC.exe
Token: 34	716	WMIC.exe
Token: 35	716	WMIC.exe
Token: 36	716	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5388	WMIC.exe
Token: SeSecurityPrivilege	5388	WMIC.exe
Token: SeTakeOwnershipPrivilege	5388	WMIC.exe
Token: SeLoadDriverPrivilege	5388	WMIC.exe
Token: SeSystemProfilePrivilege	5388	WMIC.exe
Token: SeSystemtimePrivilege	5388	WMIC.exe
Token: SeProfSingleProcessPrivilege	5388	WMIC.exe
Token: SeIncBasePriorityPrivilege	5388	WMIC.exe
Token: SeCreatePagefilePrivilege	5388	WMIC.exe
Token: SeBackupPrivilege	5388	WMIC.exe
Token: SeRestorePrivilege	5388	WMIC.exe
Token: SeShutdownPrivilege	5388	WMIC.exe
Token: SeDebugPrivilege	5388	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5388	WMIC.exe
Token: SeRemoteShutdownPrivilege	5388	WMIC.exe
Token: SeUndockPrivilege	5388	WMIC.exe
Token: SeManageVolumePrivilege	5388	WMIC.exe
Token: 33	5388	WMIC.exe
Token: 34	5388	WMIC.exe
Token: 35	5388	WMIC.exe
Token: 36	5388	WMIC.exe
Token: SeIncreaseQuotaPrivilege	716	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 2560	256	cmd.exe	89
PID 2560 wrote to memory of 716	2560	cmd.exe	90
PID 2560 wrote to memory of 5900	2560	cmd.exe	91
PID 256 wrote to memory of 3476	256	cmd.exe	93
PID 256 wrote to memory of 4660	256	cmd.exe	94
PID 256 wrote to memory of 4184	256	cmd.exe	95
PID 256 wrote to memory of 1400	256	cmd.exe	96
PID 256 wrote to memory of 2424	256	cmd.exe	97
PID 2424 wrote to memory of 5388	2424	cmd.exe	98
PID 2424 wrote to memory of 5480	2424	cmd.exe	99
PID 256 wrote to memory of 2560	256	cmd.exe	89
PID 2560 wrote to memory of 716	2560	cmd.exe	90
PID 2560 wrote to memory of 5900	2560	cmd.exe	91
PID 256 wrote to memory of 3476	256	cmd.exe	93
PID 256 wrote to memory of 4660	256	cmd.exe	94
PID 256 wrote to memory of 4184	256	cmd.exe	95
PID 256 wrote to memory of 1400	256	cmd.exe	96
PID 256 wrote to memory of 2424	256	cmd.exe	97
PID 2424 wrote to memory of 5388	2424	cmd.exe	98
PID 2424 wrote to memory of 5480	2424	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Spoof resources\NetFixer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:5900
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00"
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\000"
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0000"
  2⤵
  PID:4184
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0000" /v NetworkAddress /t REG_SZ /d 02-299AC292CC2 /f
  2⤵
  PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:5480
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00"
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\000"
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0000"
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0000" /v PnPCapabilities /t REG_DWORD /d 24 /f
  2⤵
  PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
  2⤵
  - Executes a command shell one-liner
  PID:2060
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
    3⤵
    PID:2436
- C:\Windows\system32\netsh.exe
  netsh interface set interface name="Ethernet" disable
  2⤵
  PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads