Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-10-2024 08:38

General

  • Target

    Perm Spoofer/dumped files/disk.bat

  • Size

    13KB

  • MD5

    0c345568b15f4163d3955388cfa615f4

  • SHA1

    069c7b499e8f68fb90d316d6114440ef762507d6

  • SHA256

    28dc4e8c24c16af0910f3542ec8ae12376e668e45ba310a7f25c87ab4bfb89e8

  • SHA512

    d4619bbb7bfeccf0bb3ea7259fec6a8324aadd544017ee0df0390339d112fd0ced6707d91fc5036faf2c4cbcc9326c4ba57befbbdf909c2306c109acdba6c543

  • SSDEEP

    192:dIo4yR9Y9A/r1/kMUnNLyCYSvGOqHQ28lh9YDpqWkSyt1ninmdKgZ:3xR9hjF/UnECROBClh9YDpDkSy3inlo

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\disk.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\system32\net.exe
      NET FILE
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 FILE
        3⤵
          PID:2184
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell /nologo /noprofile /command "&{[ScriptBlock]::Create((cat """C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\disk.bat""") -join [Char[]]10).Invoke(@(&{$args}))}"
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2652

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2652-4-0x000007FEF4F9E000-0x000007FEF4F9F000-memory.dmp

      Filesize

      4KB

    • memory/2652-5-0x000000001B650000-0x000000001B932000-memory.dmp

      Filesize

      2.9MB

    • memory/2652-6-0x0000000002690000-0x0000000002698000-memory.dmp

      Filesize

      32KB

    • memory/2652-8-0x000007FEF4CE0000-0x000007FEF567D000-memory.dmp

      Filesize

      9.6MB

    • memory/2652-7-0x000007FEF4CE0000-0x000007FEF567D000-memory.dmp

      Filesize

      9.6MB

    • memory/2652-9-0x000007FEF4CE0000-0x000007FEF567D000-memory.dmp

      Filesize

      9.6MB

    • memory/2652-10-0x000007FEF4CE0000-0x000007FEF567D000-memory.dmp

      Filesize

      9.6MB

    • memory/2652-11-0x000007FEF4CE0000-0x000007FEF567D000-memory.dmp

      Filesize

      9.6MB

    • memory/2652-12-0x000007FEF4CE0000-0x000007FEF567D000-memory.dmp

      Filesize

      9.6MB

    • memory/2652-13-0x000007FEF4F9E000-0x000007FEF4F9F000-memory.dmp

      Filesize

      4KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.