Overview
overview
9Static
static
3sus/Pluton...er.exe
windows11-21h2-x64
3sus/data/c...er.bat
windows11-21h2-x64
9sus/data/d...er.bat
windows11-21h2-x64
8sus/data/driver.sys
windows11-21h2-x64
1sus/data/kdmapper.exe
windows11-21h2-x64
1sus/data/m...er.bat
windows11-21h2-x64
3sus/data/spoofer.bat
windows11-21h2-x64
1sus/data/spoofer.exe
windows11-21h2-x64
1sus/run.bat
windows11-21h2-x64
1Analysis
-
max time kernel
1s -
max time network
258s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-08-2024 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sus/PlutoniumSpoofer.exe
Resource
win11-20240802-en
windows11-21h2-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
sus/data/createuser.bat
Resource
win11-20240802-en
windows11-21h2-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
sus/data/deleteuser.bat
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
sus/data/driver.sys
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
sus/data/kdmapper.exe
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
sus/data/macchanger.bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral7
Sample
sus/data/spoofer.bat
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
sus/data/spoofer.exe
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
sus/run.bat
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
300 seconds
General
-
Target
sus/data/macchanger.bat
-
Size
2KB
-
MD5
86630f471a1c7f40e8494347f9ab8249
-
SHA1
10a2139adfb884f01799de89bf9b9ccb2a8bb460
-
SHA256
c15faade0e71acd4abcb60a7e9f3f002a46d3d47bd294f7b12d811c871d1292c
-
SHA512
666fe7866c2bedc78aad081bddf7e4dc8a9038b173527dc9464dd9c0776314a8c3e1ec7f4d0f34aff0d946b94ed1178a5c665d79173d1bfe0a0a611f6af65369
Score
3/10
Malware Config
Signatures
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2952 WMIC.exe Token: SeSecurityPrivilege 2952 WMIC.exe Token: SeTakeOwnershipPrivilege 2952 WMIC.exe Token: SeLoadDriverPrivilege 2952 WMIC.exe Token: SeSystemProfilePrivilege 2952 WMIC.exe Token: SeSystemtimePrivilege 2952 WMIC.exe Token: SeProfSingleProcessPrivilege 2952 WMIC.exe Token: SeIncBasePriorityPrivilege 2952 WMIC.exe Token: SeCreatePagefilePrivilege 2952 WMIC.exe Token: SeBackupPrivilege 2952 WMIC.exe Token: SeRestorePrivilege 2952 WMIC.exe Token: SeShutdownPrivilege 2952 WMIC.exe Token: SeDebugPrivilege 2952 WMIC.exe Token: SeSystemEnvironmentPrivilege 2952 WMIC.exe Token: SeRemoteShutdownPrivilege 2952 WMIC.exe Token: SeUndockPrivilege 2952 WMIC.exe Token: SeManageVolumePrivilege 2952 WMIC.exe Token: 33 2952 WMIC.exe Token: 34 2952 WMIC.exe Token: 35 2952 WMIC.exe Token: 36 2952 WMIC.exe Token: SeIncreaseQuotaPrivilege 2952 WMIC.exe Token: SeSecurityPrivilege 2952 WMIC.exe Token: SeTakeOwnershipPrivilege 2952 WMIC.exe Token: SeLoadDriverPrivilege 2952 WMIC.exe Token: SeSystemProfilePrivilege 2952 WMIC.exe Token: SeSystemtimePrivilege 2952 WMIC.exe Token: SeProfSingleProcessPrivilege 2952 WMIC.exe Token: SeIncBasePriorityPrivilege 2952 WMIC.exe Token: SeCreatePagefilePrivilege 2952 WMIC.exe Token: SeBackupPrivilege 2952 WMIC.exe Token: SeRestorePrivilege 2952 WMIC.exe Token: SeShutdownPrivilege 2952 WMIC.exe Token: SeDebugPrivilege 2952 WMIC.exe Token: SeSystemEnvironmentPrivilege 2952 WMIC.exe Token: SeRemoteShutdownPrivilege 2952 WMIC.exe Token: SeUndockPrivilege 2952 WMIC.exe Token: SeManageVolumePrivilege 2952 WMIC.exe Token: 33 2952 WMIC.exe Token: 34 2952 WMIC.exe Token: 35 2952 WMIC.exe Token: 36 2952 WMIC.exe Token: SeIncreaseQuotaPrivilege 860 WMIC.exe Token: SeSecurityPrivilege 860 WMIC.exe Token: SeTakeOwnershipPrivilege 860 WMIC.exe Token: SeLoadDriverPrivilege 860 WMIC.exe Token: SeSystemProfilePrivilege 860 WMIC.exe Token: SeSystemtimePrivilege 860 WMIC.exe Token: SeProfSingleProcessPrivilege 860 WMIC.exe Token: SeIncBasePriorityPrivilege 860 WMIC.exe Token: SeCreatePagefilePrivilege 860 WMIC.exe Token: SeBackupPrivilege 860 WMIC.exe Token: SeRestorePrivilege 860 WMIC.exe Token: SeShutdownPrivilege 860 WMIC.exe Token: SeDebugPrivilege 860 WMIC.exe Token: SeSystemEnvironmentPrivilege 860 WMIC.exe Token: SeRemoteShutdownPrivilege 860 WMIC.exe Token: SeUndockPrivilege 860 WMIC.exe Token: SeManageVolumePrivilege 860 WMIC.exe Token: 33 860 WMIC.exe Token: 34 860 WMIC.exe Token: 35 860 WMIC.exe Token: 36 860 WMIC.exe Token: SeIncreaseQuotaPrivilege 860 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 248 wrote to memory of 2540 248 cmd.exe 80 PID 248 wrote to memory of 2540 248 cmd.exe 80 PID 2540 wrote to memory of 2952 2540 cmd.exe 81 PID 2540 wrote to memory of 2952 2540 cmd.exe 81 PID 2540 wrote to memory of 2312 2540 cmd.exe 82 PID 2540 wrote to memory of 2312 2540 cmd.exe 82 PID 248 wrote to memory of 2740 248 cmd.exe 84 PID 248 wrote to memory of 2740 248 cmd.exe 84 PID 248 wrote to memory of 1592 248 cmd.exe 85 PID 248 wrote to memory of 1592 248 cmd.exe 85 PID 248 wrote to memory of 4184 248 cmd.exe 86 PID 248 wrote to memory of 4184 248 cmd.exe 86 PID 248 wrote to memory of 1684 248 cmd.exe 87 PID 248 wrote to memory of 1684 248 cmd.exe 87 PID 248 wrote to memory of 4848 248 cmd.exe 88 PID 248 wrote to memory of 4848 248 cmd.exe 88 PID 4848 wrote to memory of 860 4848 cmd.exe 89 PID 4848 wrote to memory of 860 4848 cmd.exe 89 PID 4848 wrote to memory of 4308 4848 cmd.exe 90 PID 4848 wrote to memory of 4308 4848 cmd.exe 90 PID 248 wrote to memory of 3660 248 cmd.exe 91 PID 248 wrote to memory of 3660 248 cmd.exe 91 PID 248 wrote to memory of 1696 248 cmd.exe 92 PID 248 wrote to memory of 1696 248 cmd.exe 92 PID 248 wrote to memory of 664 248 cmd.exe 93 PID 248 wrote to memory of 664 248 cmd.exe 93 PID 248 wrote to memory of 1996 248 cmd.exe 94 PID 248 wrote to memory of 1996 248 cmd.exe 94 PID 248 wrote to memory of 404 248 cmd.exe 95 PID 248 wrote to memory of 404 248 cmd.exe 95 PID 404 wrote to memory of 744 404 cmd.exe 96 PID 404 wrote to memory of 744 404 cmd.exe 96 PID 248 wrote to memory of 3560 248 cmd.exe 97 PID 248 wrote to memory of 3560 248 cmd.exe 97 PID 248 wrote to memory of 2540 248 cmd.exe 80 PID 248 wrote to memory of 2540 248 cmd.exe 80 PID 2540 wrote to memory of 2952 2540 cmd.exe 81 PID 2540 wrote to memory of 2952 2540 cmd.exe 81 PID 2540 wrote to memory of 2312 2540 cmd.exe 82 PID 2540 wrote to memory of 2312 2540 cmd.exe 82 PID 248 wrote to memory of 2740 248 cmd.exe 84 PID 248 wrote to memory of 2740 248 cmd.exe 84 PID 248 wrote to memory of 1592 248 cmd.exe 85 PID 248 wrote to memory of 1592 248 cmd.exe 85 PID 248 wrote to memory of 4184 248 cmd.exe 86 PID 248 wrote to memory of 4184 248 cmd.exe 86 PID 248 wrote to memory of 1684 248 cmd.exe 87 PID 248 wrote to memory of 1684 248 cmd.exe 87 PID 248 wrote to memory of 4848 248 cmd.exe 88 PID 248 wrote to memory of 4848 248 cmd.exe 88 PID 4848 wrote to memory of 860 4848 cmd.exe 89 PID 4848 wrote to memory of 860 4848 cmd.exe 89 PID 4848 wrote to memory of 4308 4848 cmd.exe 90 PID 4848 wrote to memory of 4308 4848 cmd.exe 90 PID 248 wrote to memory of 3660 248 cmd.exe 91 PID 248 wrote to memory of 3660 248 cmd.exe 91 PID 248 wrote to memory of 1696 248 cmd.exe 92 PID 248 wrote to memory of 1696 248 cmd.exe 92 PID 248 wrote to memory of 664 248 cmd.exe 93 PID 248 wrote to memory of 664 248 cmd.exe 93 PID 248 wrote to memory of 1996 248 cmd.exe 94 PID 248 wrote to memory of 1996 248 cmd.exe 94 PID 248 wrote to memory of 404 248 cmd.exe 95 PID 248 wrote to memory of 404 248 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sus\data\macchanger.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2312
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:2740
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:1592
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:4184
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 02A46580369E /f2⤵PID:1684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:4308
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:3660
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:1696
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:664
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:1996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:744
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3560
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:2024