69dcfed1d7294e9dc9ddb41aa3d89af046d33fa119999978b6ba99b708094d43 | Triage

Analysis

max time kernel
93s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 18:50

Sharing

Report Analysis Logs

General

Target

Perm.exe
Size

1.4MB
MD5

785fcb31b0ccaf4ac9cc6a64eaf88eed
SHA1

a14000827d904d853c4b105c72c6acdafde2ff87
SHA256

69dcfed1d7294e9dc9ddb41aa3d89af046d33fa119999978b6ba99b708094d43
SHA512

bb2101ab7d100faa0768178f2855c0b69d4338ede01ec0e8fb835cf43895a130742edd316991fb4dfd667ec4c05156d2ef834c4c96645a8fc074287742b56fa9
SSDEEP

24576:E6qsgabtl9Z8N96AQ8DSoRPm/Rwn4o60OegX7Aozptl72NkoV:is9bnEN3v+DenO0Ervzd2Nkw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	Perm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3436	2208	Perm.exe	81
PID 2208 wrote to memory of 3436	2208	Perm.exe	81
PID 3436 wrote to memory of 2068	3436	cmd.exe	83
PID 3436 wrote to memory of 2068	3436	cmd.exe	83
PID 3436 wrote to memory of 4468	3436	cmd.exe	84
PID 3436 wrote to memory of 4468	3436	cmd.exe	84
PID 3436 wrote to memory of 1444	3436	cmd.exe	85
PID 3436 wrote to memory of 1444	3436	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\Perm.exe
"C:\Users\Admin\AppData\Local\Temp\Perm.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Perm.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Perm.exe" MD5
    3⤵
    PID:2068
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4468
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads