b4b6f0ce548f5ec6207bf0f8350011f953ef5d4011ff288ef5e2e0376cc18ded

Analysis

max time kernel
1s
max time network
108s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-10-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Perm Spoofer/dumped files/mac.bat
Size

1KB
MD5

707c798832f76eb383a0501b2773ec32
SHA1

3ebd0413af9929109ea0eb0045a2d26a256e771f
SHA256

940f3e68e62ad73c0668e854d821d88eacc8ea8fb8e130e42a34368ae9f5852e
SHA512

13e92ef958cfcc5686a2886b4a011f2287ec261028db0c6816d738eb715490d69ca37f8232e7bb3bebd5d49ce65bf4b9f55ae12d4af056bf569e5a1dba2f3da9

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2656	WMIC.exe
Token: SeSecurityPrivilege	2656	WMIC.exe
Token: SeTakeOwnershipPrivilege	2656	WMIC.exe
Token: SeLoadDriverPrivilege	2656	WMIC.exe
Token: SeSystemProfilePrivilege	2656	WMIC.exe
Token: SeSystemtimePrivilege	2656	WMIC.exe
Token: SeProfSingleProcessPrivilege	2656	WMIC.exe
Token: SeIncBasePriorityPrivilege	2656	WMIC.exe
Token: SeCreatePagefilePrivilege	2656	WMIC.exe
Token: SeBackupPrivilege	2656	WMIC.exe
Token: SeRestorePrivilege	2656	WMIC.exe
Token: SeShutdownPrivilege	2656	WMIC.exe
Token: SeDebugPrivilege	2656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2656	WMIC.exe
Token: SeRemoteShutdownPrivilege	2656	WMIC.exe
Token: SeUndockPrivilege	2656	WMIC.exe
Token: SeManageVolumePrivilege	2656	WMIC.exe
Token: 33	2656	WMIC.exe
Token: 34	2656	WMIC.exe
Token: 35	2656	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2656	WMIC.exe
Token: SeSecurityPrivilege	2656	WMIC.exe
Token: SeTakeOwnershipPrivilege	2656	WMIC.exe
Token: SeLoadDriverPrivilege	2656	WMIC.exe
Token: SeSystemProfilePrivilege	2656	WMIC.exe
Token: SeSystemtimePrivilege	2656	WMIC.exe
Token: SeProfSingleProcessPrivilege	2656	WMIC.exe
Token: SeIncBasePriorityPrivilege	2656	WMIC.exe
Token: SeCreatePagefilePrivilege	2656	WMIC.exe
Token: SeBackupPrivilege	2656	WMIC.exe
Token: SeRestorePrivilege	2656	WMIC.exe
Token: SeShutdownPrivilege	2656	WMIC.exe
Token: SeDebugPrivilege	2656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2656	WMIC.exe
Token: SeRemoteShutdownPrivilege	2656	WMIC.exe
Token: SeUndockPrivilege	2656	WMIC.exe
Token: SeManageVolumePrivilege	2656	WMIC.exe
Token: 33	2656	WMIC.exe
Token: 34	2656	WMIC.exe
Token: 35	2656	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2788	WMIC.exe
Token: SeSecurityPrivilege	2788	WMIC.exe
Token: SeTakeOwnershipPrivilege	2788	WMIC.exe
Token: SeLoadDriverPrivilege	2788	WMIC.exe
Token: SeSystemProfilePrivilege	2788	WMIC.exe
Token: SeSystemtimePrivilege	2788	WMIC.exe
Token: SeProfSingleProcessPrivilege	2788	WMIC.exe
Token: SeIncBasePriorityPrivilege	2788	WMIC.exe
Token: SeCreatePagefilePrivilege	2788	WMIC.exe
Token: SeBackupPrivilege	2788	WMIC.exe
Token: SeRestorePrivilege	2788	WMIC.exe
Token: SeShutdownPrivilege	2788	WMIC.exe
Token: SeDebugPrivilege	2788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2788	WMIC.exe
Token: SeRemoteShutdownPrivilege	2788	WMIC.exe
Token: SeUndockPrivilege	2788	WMIC.exe
Token: SeManageVolumePrivilege	2788	WMIC.exe
Token: 33	2788	WMIC.exe
Token: 34	2788	WMIC.exe
Token: 35	2788	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2788	WMIC.exe
Token: SeSecurityPrivilege	2788	WMIC.exe
Token: SeTakeOwnershipPrivilege	2788	WMIC.exe
Token: SeLoadDriverPrivilege	2788	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2848 wrote to memory of 2164	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2164	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2164	2848	cmd.exe	cmd.exe
PID 2164 wrote to memory of 2656	2164	cmd.exe	WMIC.exe
PID 2164 wrote to memory of 2656	2164	cmd.exe	WMIC.exe
PID 2164 wrote to memory of 2656	2164	cmd.exe	WMIC.exe
PID 2164 wrote to memory of 2384	2164	cmd.exe	findstr.exe
PID 2164 wrote to memory of 2384	2164	cmd.exe	findstr.exe
PID 2164 wrote to memory of 2384	2164	cmd.exe	findstr.exe
PID 2848 wrote to memory of 2796	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2796	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2796	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2784	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2784	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2784	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2420	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2420	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2420	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 1340	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 1340	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 1340	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2736	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2736	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2736	2848	cmd.exe	cmd.exe
PID 2736 wrote to memory of 2788	2736	cmd.exe	WMIC.exe
PID 2736 wrote to memory of 2788	2736	cmd.exe	WMIC.exe
PID 2736 wrote to memory of 2788	2736	cmd.exe	WMIC.exe
PID 2736 wrote to memory of 2708	2736	cmd.exe	findstr.exe
PID 2736 wrote to memory of 2708	2736	cmd.exe	findstr.exe
PID 2736 wrote to memory of 2708	2736	cmd.exe	findstr.exe
PID 2848 wrote to memory of 3016	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 3016	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 3016	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2636	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2636	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2636	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 1088	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 1088	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 1088	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2764	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2764	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2764	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2716	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2716	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2716	2848	cmd.exe	cmd.exe
PID 2716 wrote to memory of 2596	2716	cmd.exe	WMIC.exe
PID 2716 wrote to memory of 2596	2716	cmd.exe	WMIC.exe
PID 2716 wrote to memory of 2596	2716	cmd.exe	WMIC.exe
PID 2848 wrote to memory of 2564	2848	cmd.exe	netsh.exe
PID 2848 wrote to memory of 2564	2848	cmd.exe	netsh.exe
PID 2848 wrote to memory of 2564	2848	cmd.exe	netsh.exe
PID 2848 wrote to memory of 2164	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2164	2848	cmd.exe	cmd.exe
PID 2848 wrote to memory of 2164	2848	cmd.exe	cmd.exe
PID 2164 wrote to memory of 2656	2164	cmd.exe	WMIC.exe
PID 2164 wrote to memory of 2656	2164	cmd.exe	WMIC.exe
PID 2164 wrote to memory of 2656	2164	cmd.exe	WMIC.exe
PID 2164 wrote to memory of 2384	2164	cmd.exe	findstr.exe
PID 2164 wrote to memory of 2384	2164	cmd.exe	findstr.exe
PID 2164 wrote to memory of 2384	2164	cmd.exe	findstr.exe
PID 2848 wrote to memory of 2796	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2796	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2796	2848	cmd.exe	reg.exe
PID 2848 wrote to memory of 2784	2848	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\mac.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:2384
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\07
  2⤵
  PID:2796
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\007
  2⤵
  PID:2784
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007
  2⤵
  PID:2420
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007 /v NetworkAddress /t REG_SZ /d 7E16987BB3E6 /f
  2⤵
  PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:2708
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\07
  2⤵
  PID:3016
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\007
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007 /v PnPCapabilities /t REG_DWORD /d 24 /f
  2⤵
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
    3⤵
    PID:2596
- C:\Windows\system32\netsh.exe
  netsh interface set interface name="Local Area Connection" disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads