Overview
overview
10Static
static
7Spoofer.exe
windows11-21h2-x64
1cleaners/a...er.exe
windows11-21h2-x64
9cleaners/cleaner.bat
windows11-21h2-x64
10spoofers/C...32.exe
windows11-21h2-x64
1spoofers/C...64.exe
windows11-21h2-x64
1spoofers/C...64.sys
windows11-21h2-x64
1spoofers/g...64.sys
windows11-21h2-x64
1spoofers/s...er.bat
windows11-21h2-x64
1Resubmissions
10/07/2024, 02:30
240710-czl2gstcke 1020/06/2024, 12:39
240620-pvzs1axflf 1020/06/2024, 12:36
240620-pswcss1hrr 720/06/2024, 12:35
240620-psqgjs1hrm 1020/06/2024, 12:33
240620-prd25axdpg 10Analysis
-
max time kernel
1738s -
max time network
1751s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/06/2024, 12:39
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
cleaners/applecleaner.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
cleaners/cleaner.bat
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
spoofers/CupFixerx32.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
spoofers/CupFixerx64.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
spoofers/CupFixerx64.sys
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
spoofers/gsoftgmx64.sys
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
spoofers/serial_checker.bat
Resource
win11-20240508-en
windows11-21h2-x64
General
-
Target
spoofers/serial_checker.bat
-
Size
437B
-
MD5
0c088b6adc55c20fc375badef6f7e9a7
-
SHA1
37c865ebfe537b94534844281e9086462f3e2462
-
SHA256
51f783d41ad3a807344eb9550d65cb4638793aac71f4eb4a1a11414b24e339e1
-
SHA512
7f82c647413f997a537148ab7d1e8a5cff9fef18561783f329485dbb67ab76a2a8defa0a7304feb7e1e79645b50b8cb2d4a069ff3ec668542fdefb1adbde6f5d
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 764 WMIC.exe Token: SeSecurityPrivilege 764 WMIC.exe Token: SeTakeOwnershipPrivilege 764 WMIC.exe Token: SeLoadDriverPrivilege 764 WMIC.exe Token: SeSystemProfilePrivilege 764 WMIC.exe Token: SeSystemtimePrivilege 764 WMIC.exe Token: SeProfSingleProcessPrivilege 764 WMIC.exe Token: SeIncBasePriorityPrivilege 764 WMIC.exe Token: SeCreatePagefilePrivilege 764 WMIC.exe Token: SeBackupPrivilege 764 WMIC.exe Token: SeRestorePrivilege 764 WMIC.exe Token: SeShutdownPrivilege 764 WMIC.exe Token: SeDebugPrivilege 764 WMIC.exe Token: SeSystemEnvironmentPrivilege 764 WMIC.exe Token: SeRemoteShutdownPrivilege 764 WMIC.exe Token: SeUndockPrivilege 764 WMIC.exe Token: SeManageVolumePrivilege 764 WMIC.exe Token: 33 764 WMIC.exe Token: 34 764 WMIC.exe Token: 35 764 WMIC.exe Token: 36 764 WMIC.exe Token: SeIncreaseQuotaPrivilege 764 WMIC.exe Token: SeSecurityPrivilege 764 WMIC.exe Token: SeTakeOwnershipPrivilege 764 WMIC.exe Token: SeLoadDriverPrivilege 764 WMIC.exe Token: SeSystemProfilePrivilege 764 WMIC.exe Token: SeSystemtimePrivilege 764 WMIC.exe Token: SeProfSingleProcessPrivilege 764 WMIC.exe Token: SeIncBasePriorityPrivilege 764 WMIC.exe Token: SeCreatePagefilePrivilege 764 WMIC.exe Token: SeBackupPrivilege 764 WMIC.exe Token: SeRestorePrivilege 764 WMIC.exe Token: SeShutdownPrivilege 764 WMIC.exe Token: SeDebugPrivilege 764 WMIC.exe Token: SeSystemEnvironmentPrivilege 764 WMIC.exe Token: SeRemoteShutdownPrivilege 764 WMIC.exe Token: SeUndockPrivilege 764 WMIC.exe Token: SeManageVolumePrivilege 764 WMIC.exe Token: 33 764 WMIC.exe Token: 34 764 WMIC.exe Token: 35 764 WMIC.exe Token: 36 764 WMIC.exe Token: SeIncreaseQuotaPrivilege 128 WMIC.exe Token: SeSecurityPrivilege 128 WMIC.exe Token: SeTakeOwnershipPrivilege 128 WMIC.exe Token: SeLoadDriverPrivilege 128 WMIC.exe Token: SeSystemProfilePrivilege 128 WMIC.exe Token: SeSystemtimePrivilege 128 WMIC.exe Token: SeProfSingleProcessPrivilege 128 WMIC.exe Token: SeIncBasePriorityPrivilege 128 WMIC.exe Token: SeCreatePagefilePrivilege 128 WMIC.exe Token: SeBackupPrivilege 128 WMIC.exe Token: SeRestorePrivilege 128 WMIC.exe Token: SeShutdownPrivilege 128 WMIC.exe Token: SeDebugPrivilege 128 WMIC.exe Token: SeSystemEnvironmentPrivilege 128 WMIC.exe Token: SeRemoteShutdownPrivilege 128 WMIC.exe Token: SeUndockPrivilege 128 WMIC.exe Token: SeManageVolumePrivilege 128 WMIC.exe Token: 33 128 WMIC.exe Token: 34 128 WMIC.exe Token: 35 128 WMIC.exe Token: 36 128 WMIC.exe Token: SeIncreaseQuotaPrivilege 128 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4260 wrote to memory of 764 4260 cmd.exe 79 PID 4260 wrote to memory of 764 4260 cmd.exe 79 PID 4260 wrote to memory of 128 4260 cmd.exe 81 PID 4260 wrote to memory of 128 4260 cmd.exe 81 PID 4260 wrote to memory of 3928 4260 cmd.exe 82 PID 4260 wrote to memory of 3928 4260 cmd.exe 82 PID 4260 wrote to memory of 1224 4260 cmd.exe 83 PID 4260 wrote to memory of 1224 4260 cmd.exe 83 PID 4260 wrote to memory of 3340 4260 cmd.exe 84 PID 4260 wrote to memory of 3340 4260 cmd.exe 84 PID 4260 wrote to memory of 2356 4260 cmd.exe 85 PID 4260 wrote to memory of 2356 4260 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\spoofers\serial_checker.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get model, serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:128
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber2⤵PID:3928
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵PID:1224
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid2⤵PID:3340
-
-
C:\Windows\system32\getmac.exegetmac2⤵PID:2356
-