Overview
overview
10Static
static
7Spoofer.exe
windows11-21h2-x64
1cleaners/a...er.exe
windows11-21h2-x64
9cleaners/cleaner.bat
windows11-21h2-x64
10spoofers/C...32.exe
windows11-21h2-x64
1spoofers/C...64.exe
windows11-21h2-x64
1spoofers/C...64.sys
windows11-21h2-x64
1spoofers/g...64.sys
windows11-21h2-x64
1spoofers/s...er.bat
windows11-21h2-x64
1Resubmissions
10/07/2024, 02:30
240710-czl2gstcke 1020/06/2024, 12:39
240620-pvzs1axflf 1020/06/2024, 12:36
240620-pswcss1hrr 720/06/2024, 12:35
240620-psqgjs1hrm 1020/06/2024, 12:33
240620-prd25axdpg 10Analysis
-
max time kernel
1487s -
max time network
1492s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/06/2024, 12:35
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
cleaners/applecleaner.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
cleaners/cleaner.bat
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
spoofers/CupFixerx32.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
spoofers/CupFixerx64.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
spoofers/CupFixerx64.sys
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
spoofers/gsoftgmx64.sys
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
spoofers/serial_checker.bat
Resource
win11-20240611-en
windows11-21h2-x64
General
-
Target
spoofers/serial_checker.bat
-
Size
437B
-
MD5
0c088b6adc55c20fc375badef6f7e9a7
-
SHA1
37c865ebfe537b94534844281e9086462f3e2462
-
SHA256
51f783d41ad3a807344eb9550d65cb4638793aac71f4eb4a1a11414b24e339e1
-
SHA512
7f82c647413f997a537148ab7d1e8a5cff9fef18561783f329485dbb67ab76a2a8defa0a7304feb7e1e79645b50b8cb2d4a069ff3ec668542fdefb1adbde6f5d
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 712 WMIC.exe Token: SeSecurityPrivilege 712 WMIC.exe Token: SeTakeOwnershipPrivilege 712 WMIC.exe Token: SeLoadDriverPrivilege 712 WMIC.exe Token: SeSystemProfilePrivilege 712 WMIC.exe Token: SeSystemtimePrivilege 712 WMIC.exe Token: SeProfSingleProcessPrivilege 712 WMIC.exe Token: SeIncBasePriorityPrivilege 712 WMIC.exe Token: SeCreatePagefilePrivilege 712 WMIC.exe Token: SeBackupPrivilege 712 WMIC.exe Token: SeRestorePrivilege 712 WMIC.exe Token: SeShutdownPrivilege 712 WMIC.exe Token: SeDebugPrivilege 712 WMIC.exe Token: SeSystemEnvironmentPrivilege 712 WMIC.exe Token: SeRemoteShutdownPrivilege 712 WMIC.exe Token: SeUndockPrivilege 712 WMIC.exe Token: SeManageVolumePrivilege 712 WMIC.exe Token: 33 712 WMIC.exe Token: 34 712 WMIC.exe Token: 35 712 WMIC.exe Token: 36 712 WMIC.exe Token: SeIncreaseQuotaPrivilege 712 WMIC.exe Token: SeSecurityPrivilege 712 WMIC.exe Token: SeTakeOwnershipPrivilege 712 WMIC.exe Token: SeLoadDriverPrivilege 712 WMIC.exe Token: SeSystemProfilePrivilege 712 WMIC.exe Token: SeSystemtimePrivilege 712 WMIC.exe Token: SeProfSingleProcessPrivilege 712 WMIC.exe Token: SeIncBasePriorityPrivilege 712 WMIC.exe Token: SeCreatePagefilePrivilege 712 WMIC.exe Token: SeBackupPrivilege 712 WMIC.exe Token: SeRestorePrivilege 712 WMIC.exe Token: SeShutdownPrivilege 712 WMIC.exe Token: SeDebugPrivilege 712 WMIC.exe Token: SeSystemEnvironmentPrivilege 712 WMIC.exe Token: SeRemoteShutdownPrivilege 712 WMIC.exe Token: SeUndockPrivilege 712 WMIC.exe Token: SeManageVolumePrivilege 712 WMIC.exe Token: 33 712 WMIC.exe Token: 34 712 WMIC.exe Token: 35 712 WMIC.exe Token: 36 712 WMIC.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4984 wrote to memory of 712 4984 cmd.exe 81 PID 4984 wrote to memory of 712 4984 cmd.exe 81 PID 4984 wrote to memory of 3732 4984 cmd.exe 83 PID 4984 wrote to memory of 3732 4984 cmd.exe 83 PID 4984 wrote to memory of 3740 4984 cmd.exe 84 PID 4984 wrote to memory of 3740 4984 cmd.exe 84 PID 4984 wrote to memory of 1932 4984 cmd.exe 86 PID 4984 wrote to memory of 1932 4984 cmd.exe 86 PID 4984 wrote to memory of 4416 4984 cmd.exe 87 PID 4984 wrote to memory of 4416 4984 cmd.exe 87 PID 4984 wrote to memory of 3104 4984 cmd.exe 88 PID 4984 wrote to memory of 3104 4984 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\spoofers\serial_checker.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get model, serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:712
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber2⤵PID:3740
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵PID:1932
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid2⤵PID:4416
-
-
C:\Windows\system32\getmac.exegetmac2⤵PID:3104
-