Analysis
-
max time kernel
25s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
03/09/2024, 22:08
General
-
Target
Perm Spoofer.exe
-
Size
28.1MB
-
MD5
6d580b009bd7e0c1d5d2e1da54191743
-
SHA1
4e3568f77dfb112c6a30c9f04fece99b0a219153
-
SHA256
33db059ad0344af99a91e5dc4645b4ed21f6476301dbcdd9b7938fa9f5b240fa
-
SHA512
2e7b119a035295da2a1c666f6b4d1c2de1cc2aaf2392dc4c4f76bb4edef74022902b50b539aa26a0c035c7f4d87442dc498236a37ea50e5a7408af355bad0325
-
SSDEEP
786432:DEpTc844UEVZOh3yWhcs8sCir3G9uyRpwn3uY4dws:4S8WlinvU3yu+E3p7s
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 7 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Perm Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Perm Spoofer.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
46.9MB
-
Filesize
46.9MB
-
Filesize
46.9MB
-
Filesize
46.9MB
-
Filesize
46.9MB
-
Filesize
46.9MB
-
Filesize
46.9MB
-
Filesize
46.9MB
-
Filesize
432KB
-
Filesize
46.9MB