Analysis

  • user interaction
    yes
  • max time kernel
    64s
  • max time network
    93s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 15:40

General

  • Target
    betapanties.exe
  • Size 453.6MB
  • Sample261102-s3887abs2t
  • SHA256 78da40f1ebd48e23c384d3c8b827330f18000041277ec3df6c42231fb1c42b68
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\betapanties.exe
    "C:\Users\Admin\AppData\Local\Temp\betapanties.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh" advfirewall set allprofiles state off
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:4172
  • C:\PerfLogs\bin\Games\nethost.exe
    C:\PerfLogs\bin\Games\nethost.exe
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh" advfirewall set allprofiles state off
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:2288

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        TazkMgr.exe.config

        • Path C:\PerfLogs\bin\Games\Popup\TazkMgr.exe.config
        • Size 187B
        • SHA256 f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15
        • MD5 SHA1 SHA512 TLSH

        2.gif

        • Path C:\PerfLogs\bin\Games\Popup\imgOv1\2.gif
        • Size 840KB
        • SHA256 1fdbac2ad3de517c2aaec0f352721d0653632b8f1fbe097ae7f34cc1beb2261a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        302.jpg

        • Path C:\PerfLogs\bin\Games\Popup\imgOv2\302.jpg
        • Size 80KB
        • SHA256 42bf5dc9a62a58363396ecbb52ac4695777c4b3a4250a1958bcc6e9ecff6ef7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        308.jpg

        • Path C:\PerfLogs\bin\Games\Popup\imgOv2\308.jpg
        • Size 118KB
        • SHA256 c62b79d295e8bee9eddb6591dee15cb70f223b8c5325e8d421c9422af22b56dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        317.jpg

        • Path C:\PerfLogs\bin\Games\Popup\imgOv2\317.jpg
        • Size 83KB
        • SHA256 eae4b39612c35cd3506c5d81b69880a185eed83ff952b4f7b3c87d6241359d9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        325.jpg

        • Path C:\PerfLogs\bin\Games\Popup\imgOv2\325.jpg
        • Size 67KB
        • SHA256 d505169cdbf1bcf637236deeaa8efc0b6e022205e21f901f54716710b5e7ceab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        329.jpg

        • Path C:\PerfLogs\bin\Games\Popup\imgOv2\329.jpg
        • Size 185KB
        • SHA256 d12e25c28f0e863afff5242a6e4cd58e22a1ee5d5d67d39ca8540d5fb95c2d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        336.jpg

        • Path C:\PerfLogs\bin\Games\Popup\imgOv2\336.jpg
        • Size 720KB
        • SHA256 581390264d03eee13c6dc28c6b97f92c912908fbfd0a6eff33a6d6396e734493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        340.jpg

        • Path C:\PerfLogs\bin\Games\Popup\imgOv2\340.jpg
        • Size 67KB
        • SHA256 d2255432936296bab90f54391d0fd840a518148edaed55d2599fde6298a06b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        183.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\183.jpg
        • Size 480KB
        • SHA256 ceae7da6ffe314b910fcad427e5980ad70425ed38739d7b0b2b52ee833d8c441
        • MD5 SHA1 SHA512 SSDEEP TLSH

        185.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\185.jpg
        • Size 167KB
        • SHA256 3c41b592385a0400c12be3cc419da03bbdabfbd9423ef35feb0d85d85fce95b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        187.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\187.jpg
        • Size 162KB
        • SHA256 aeb9fec17516817b4213e9d4095b6b87bc56f0d97786bf8301d5d15d118731cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        189.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\189.jpg
        • Size 72KB
        • SHA256 a6988b83c7e799a604e72cc8b138544a53719a59dbc8daa492ef0a5ef2a6f9a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        191.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\191.jpg
        • Size 71KB
        • SHA256 00ae5b6751bd9290b9d796a6b683c4d96afd7daacce7dd7ae3d16994bed38799
        • MD5 SHA1 SHA512 SSDEEP TLSH

        193.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\193.jpg
        • Size 59KB
        • SHA256 f180ec52f7c763bf419cfd2c7e264db20acfb519728adf6df8d09e16e3bdf828
        • MD5 SHA1 SHA512 SSDEEP TLSH

        195.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\195.jpg
        • Size 107KB
        • SHA256 3e5b53de6f99178e2b7ba29129ff5abd1e53d6e8607d2f9dcdfc78d12196795d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        197.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\197.jpg
        • Size 331KB
        • SHA256 3799ab3285da891a33ce0525ae9fd508fc8e6ea1530595e44854731c8b2ce8b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        199.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\199.jpg
        • Size 642KB
        • SHA256 46c7c8383ddd8733d906c34a3a5a22ea614442cacffed4e1ada61f1ebb60e04d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        201.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\201.jpg
        • Size 230KB
        • SHA256 59f53e4d73e13cc371e24d313a67248eb4e622a22ade6040065c79763fd9c06c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        203.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\203.jpg
        • Size 364KB
        • SHA256 4216c171ebaf9d2d3b2ca39ae035f9c89ca7fc0bda69ee84b2f22182c31a1060
        • MD5 SHA1 SHA512 SSDEEP TLSH

        207.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\207.jpg
        • Size 104KB
        • SHA256 62e22d138d4874fafc42f5f63fef3bdbc2d6ee876d0cfcb7e74107fe7dbaeb19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        209.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\209.jpg
        • Size 141KB
        • SHA256 3a0c98531983f617a75a05f8be1d86c0f009b892e4cd06be25854eb52474328f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        211.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\211.jpg
        • Size 757KB
        • SHA256 294cda6a795899e62e3f78158928fba17f9b25de7429b8f3f251d8e359a7a3a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        213.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\213.jpg
        • Size 105KB
        • SHA256 e62df18aac67394b1c5754d177bc3da8ef1aa597bd90cc248458026fe0b1f68f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        215.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\215.jpg
        • Size 92KB
        • SHA256 76fd880f835798cde2d1f20f184d0258cbc202a8820cda7d2207b48c7fa84d24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        217.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\217.jpg
        • Size 545KB
        • SHA256 713acd3a5c6d8f662d558c4a250a4a696098acedd42994b7e42e8251f1aaca4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        219.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\219.jpg
        • Size 342KB
        • SHA256 205b98bc1240e57286c2234d8fb834b89a2958bc230d806e81ea8c72b3245a34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        221.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\221.jpg
        • Size 133KB
        • SHA256 7119db40115c9b4d5fa6322db8afe8612fbd0a4d5a39447e2dbdac7f8cf56d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        223.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\223.jpg
        • Size 276KB
        • SHA256 03d38c438662621edb4802c49bdb0c09885536b22bf563d594c8577dc1d8432b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        230.gif

        • Path C:\PerfLogs\bin\Games\Popup\img\230.gif
        • Size 5.0MB
        • SHA256 89b41c26be9bbff413b5c2974fb157d371ddb19bd7231de082ea0845cfb3f993
        • MD5 SHA1 SHA512 SSDEEP TLSH

        242.gif

        • Path C:\PerfLogs\bin\Games\Popup\img\242.gif
        • Size 11.3MB
        • SHA256 9edb0c72cdc7ad1f28fdf0656d74963179164221085f9fa04c482b6e3c245141
        • MD5 SHA1 SHA512 SSDEEP TLSH

        254.gif

        • Path C:\PerfLogs\bin\Games\Popup\img\254.gif
        • Size 13.4MB
        • SHA256 fe33865c44cf5e2c4695df43f85e378e2b638e89187740bc795cc6fe4473b527
        • MD5 SHA1 SHA512 SSDEEP TLSH

        261.gif

        • Path C:\PerfLogs\bin\Games\Popup\img\261.gif
        • Size 9.4MB
        • SHA256 c3242f0ccb3745698b0a68db15aaa1ceee4bf709be695841d6f457c4a74d3046
        • MD5 SHA1 SHA512 SSDEEP TLSH

        277.gif

        • Path C:\PerfLogs\bin\Games\Popup\img\277.gif
        • Size 14.6MB
        • SHA256 8f57d39a91622cabf60c2b1cc03271141d9516bdf8add3948eff458a4bab1a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        356.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\356.jpg
        • Size 325KB
        • SHA256 9a115b8421e79bf10d37ef619aa3624d7afd96ce626bc0c020e9516d1f838fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        358.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\358.jpg
        • Size 142KB
        • SHA256 0fac607f2b4b6fc085de5e0cf347c27c4fba3bbdf15f7af208537900c8cbfada
        • MD5 SHA1 SHA512 SSDEEP TLSH

        361.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\361.jpg
        • Size 115KB
        • SHA256 6666efb29b8eda66b35dc512c83c1ff96e20a59823a1d693f512435fe7abfe3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        363.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\363.jpg
        • Size 107KB
        • SHA256 406116db5076a9843579367e06e473dcf78af5e7959e73773653e4a9d681c8a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        365.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\365.jpg
        • Size 94KB
        • SHA256 601143cb9e881328875450a329085be0d98b1d0e4d8170f639721d449a78f776
        • MD5 SHA1 SHA512 SSDEEP TLSH

        373.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\373.jpg
        • Size 83KB
        • SHA256 a9cfa2eedf5b31bce850c88a24f2f793d7db39382d8503afc3c66b94ba234098
        • MD5 SHA1 SHA512 SSDEEP TLSH

        378.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\378.jpg
        • Size 70KB
        • SHA256 cca2008578b2cf1e6e579f4d674dd5974255c0e55d53e7821eb86436c86fd9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        382.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\382.jpg
        • Size 95KB
        • SHA256 6813a7cd004997905e412e80e5707b345e07de595f9f0c76574e9443fa749581
        • MD5 SHA1 SHA512 SSDEEP TLSH

        383.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\383.jpg
        • Size 68KB
        • SHA256 a2667715b87ce4a0ebc0de1842e21202b460722bac9a83661ca519d781b275fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        386.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\386.jpg
        • Size 54KB
        • SHA256 270546291abac4508a09e04f0f9073d84a14af11ca6d9ec2fafedbb250bde721
        • MD5 SHA1 SHA512 SSDEEP TLSH

        387.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\387.jpg
        • Size 81KB
        • SHA256 086fc8ed87b1a53395a313ffa53e704d1ff9e3b528ee65c15ffe48bddc1cb16c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        388.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\388.jpg
        • Size 126KB
        • SHA256 ac594405e53263e3d1959a3458a918bb751afa6c74a0c69f5a1ab327c50f874e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        389.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\389.jpg
        • Size 77KB
        • SHA256 564dd52497af6e5d45b1b6ad64cefdf58c8193062275e61194c2933e6be41961
        • MD5 SHA1 SHA512 SSDEEP TLSH

        390.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\390.jpg
        • Size 99KB
        • SHA256 e84827f0e703b0ff91acc755e0cbd004373b1b99149063b71ebaad75ee882770
        • MD5 SHA1 SHA512 SSDEEP TLSH

        393.jpg

        • Path C:\PerfLogs\bin\Games\Popup\img\393.jpg
        • Size 67KB
        • SHA256 f12d4f6f22483da53068f908c3c321e4dd667d41a9b92be48a215ad76c081001
        • MD5 SHA1 SHA512 SSDEEP TLSH