Overview
overview
10Static
static
10Perm Spoof...er.exe
windows7-x64
1Perm Spoof...er.exe
windows10-2004-x64
1Perm Spoof...on.dll
windows7-x64
1Perm Spoof...on.dll
windows10-2004-x64
1Perm Spoof...ec.dll
windows7-x64
1Perm Spoof...ec.dll
windows10-2004-x64
1Perm Spoofer/bz2.dll
windows7-x64
1Perm Spoofer/bz2.dll
windows10-2004-x64
1Perm Spoof...ed.exe
windows7-x64
1Perm Spoof...ed.exe
windows10-2004-x64
1Perm Spoof...F2.bat
windows7-x64
1Perm Spoof...F2.bat
windows10-2004-x64
5Perm Spoof...ck.exe
windows7-x64
1Perm Spoof...ck.exe
windows10-2004-x64
1Perm Spoof...hk.sys
windows10-2004-x64
1Perm Spoof...DF.bat
windows7-x64
1Perm Spoof...DF.bat
windows10-2004-x64
1Perm Spoof...64.dll
windows7-x64
1Perm Spoof...64.dll
windows10-2004-x64
1Perm Spoof...64.dll
windows7-x64
1Perm Spoof...64.dll
windows10-2004-x64
1Perm Spoof...64.dll
windows7-x64
1Perm Spoof...64.dll
windows10-2004-x64
1Perm Spoof...sk.bat
windows7-x64
1Perm Spoof...sk.bat
windows10-2004-x64
6Perm Spoof...ls.exe
windows7-x64
10Perm Spoof...ls.exe
windows10-2004-x64
10Perm Spoof...4e.sys
windows10-2004-x64
1Perm Spoof...ac.bat
windows7-x64
3Perm Spoof...ac.bat
windows10-2004-x64
3Perm Spoof...ss.exe
windows7-x64
1Perm Spoof...ss.exe
windows10-2004-x64
1Analysis
-
max time kernel
1s -
max time network
108s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21-10-2024 08:38
Behavioral task
behavioral1
Sample
Perm Spoofer/Perm Spoofer.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Perm Spoofer/Perm Spoofer.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Perm Spoofer/brotlicommon.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Perm Spoofer/brotlicommon.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Perm Spoofer/brotlidec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Perm Spoofer/brotlidec.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Perm Spoofer/bz2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Perm Spoofer/bz2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Perm Spoofer/cracked.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Perm Spoofer/cracked.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Perm Spoofer/dumped files/ASUSPDF2.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Perm Spoofer/dumped files/ASUSPDF2.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Perm Spoofer/dumped files/AsDeviceCheck.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Perm Spoofer/dumped files/AsDeviceCheck.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Perm Spoofer/dumped files/AsDeviceChk.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Perm Spoofer/dumped files/AsusPDF.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral17
Sample
Perm Spoofer/dumped files/AsusPDF.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Perm Spoofer/dumped files/afuefix64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
Perm Spoofer/dumped files/afuefix64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Perm Spoofer/dumped files/amideefix64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
Perm Spoofer/dumped files/amideefix64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Perm Spoofer/dumped files/bootx64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
Perm Spoofer/dumped files/bootx64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Perm Spoofer/dumped files/disk.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
Perm Spoofer/dumped files/disk.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Perm Spoofer/dumped files/fixserials.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
Perm Spoofer/dumped files/fixserials.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Perm Spoofer/dumped files/iqvw64e.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Perm Spoofer/dumped files/mac.bat
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
Perm Spoofer/dumped files/mac.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Perm Spoofer/dumped files/tpmbypass.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
Perm Spoofer/dumped files/tpmbypass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Perm Spoofer/dumped files/mac.bat
-
Size
1KB
-
MD5
707c798832f76eb383a0501b2773ec32
-
SHA1
3ebd0413af9929109ea0eb0045a2d26a256e771f
-
SHA256
940f3e68e62ad73c0668e854d821d88eacc8ea8fb8e130e42a34368ae9f5852e
-
SHA512
13e92ef958cfcc5686a2886b4a011f2287ec261028db0c6816d738eb715490d69ca37f8232e7bb3bebd5d49ce65bf4b9f55ae12d4af056bf569e5a1dba2f3da9
Malware Config
Signatures
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2656 WMIC.exe Token: SeSecurityPrivilege 2656 WMIC.exe Token: SeTakeOwnershipPrivilege 2656 WMIC.exe Token: SeLoadDriverPrivilege 2656 WMIC.exe Token: SeSystemProfilePrivilege 2656 WMIC.exe Token: SeSystemtimePrivilege 2656 WMIC.exe Token: SeProfSingleProcessPrivilege 2656 WMIC.exe Token: SeIncBasePriorityPrivilege 2656 WMIC.exe Token: SeCreatePagefilePrivilege 2656 WMIC.exe Token: SeBackupPrivilege 2656 WMIC.exe Token: SeRestorePrivilege 2656 WMIC.exe Token: SeShutdownPrivilege 2656 WMIC.exe Token: SeDebugPrivilege 2656 WMIC.exe Token: SeSystemEnvironmentPrivilege 2656 WMIC.exe Token: SeRemoteShutdownPrivilege 2656 WMIC.exe Token: SeUndockPrivilege 2656 WMIC.exe Token: SeManageVolumePrivilege 2656 WMIC.exe Token: 33 2656 WMIC.exe Token: 34 2656 WMIC.exe Token: 35 2656 WMIC.exe Token: SeIncreaseQuotaPrivilege 2656 WMIC.exe Token: SeSecurityPrivilege 2656 WMIC.exe Token: SeTakeOwnershipPrivilege 2656 WMIC.exe Token: SeLoadDriverPrivilege 2656 WMIC.exe Token: SeSystemProfilePrivilege 2656 WMIC.exe Token: SeSystemtimePrivilege 2656 WMIC.exe Token: SeProfSingleProcessPrivilege 2656 WMIC.exe Token: SeIncBasePriorityPrivilege 2656 WMIC.exe Token: SeCreatePagefilePrivilege 2656 WMIC.exe Token: SeBackupPrivilege 2656 WMIC.exe Token: SeRestorePrivilege 2656 WMIC.exe Token: SeShutdownPrivilege 2656 WMIC.exe Token: SeDebugPrivilege 2656 WMIC.exe Token: SeSystemEnvironmentPrivilege 2656 WMIC.exe Token: SeRemoteShutdownPrivilege 2656 WMIC.exe Token: SeUndockPrivilege 2656 WMIC.exe Token: SeManageVolumePrivilege 2656 WMIC.exe Token: 33 2656 WMIC.exe Token: 34 2656 WMIC.exe Token: 35 2656 WMIC.exe Token: SeIncreaseQuotaPrivilege 2788 WMIC.exe Token: SeSecurityPrivilege 2788 WMIC.exe Token: SeTakeOwnershipPrivilege 2788 WMIC.exe Token: SeLoadDriverPrivilege 2788 WMIC.exe Token: SeSystemProfilePrivilege 2788 WMIC.exe Token: SeSystemtimePrivilege 2788 WMIC.exe Token: SeProfSingleProcessPrivilege 2788 WMIC.exe Token: SeIncBasePriorityPrivilege 2788 WMIC.exe Token: SeCreatePagefilePrivilege 2788 WMIC.exe Token: SeBackupPrivilege 2788 WMIC.exe Token: SeRestorePrivilege 2788 WMIC.exe Token: SeShutdownPrivilege 2788 WMIC.exe Token: SeDebugPrivilege 2788 WMIC.exe Token: SeSystemEnvironmentPrivilege 2788 WMIC.exe Token: SeRemoteShutdownPrivilege 2788 WMIC.exe Token: SeUndockPrivilege 2788 WMIC.exe Token: SeManageVolumePrivilege 2788 WMIC.exe Token: 33 2788 WMIC.exe Token: 34 2788 WMIC.exe Token: 35 2788 WMIC.exe Token: SeIncreaseQuotaPrivilege 2788 WMIC.exe Token: SeSecurityPrivilege 2788 WMIC.exe Token: SeTakeOwnershipPrivilege 2788 WMIC.exe Token: SeLoadDriverPrivilege 2788 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2164 2848 cmd.exe 32 PID 2848 wrote to memory of 2164 2848 cmd.exe 32 PID 2848 wrote to memory of 2164 2848 cmd.exe 32 PID 2164 wrote to memory of 2656 2164 cmd.exe 33 PID 2164 wrote to memory of 2656 2164 cmd.exe 33 PID 2164 wrote to memory of 2656 2164 cmd.exe 33 PID 2164 wrote to memory of 2384 2164 cmd.exe 34 PID 2164 wrote to memory of 2384 2164 cmd.exe 34 PID 2164 wrote to memory of 2384 2164 cmd.exe 34 PID 2848 wrote to memory of 2796 2848 cmd.exe 36 PID 2848 wrote to memory of 2796 2848 cmd.exe 36 PID 2848 wrote to memory of 2796 2848 cmd.exe 36 PID 2848 wrote to memory of 2784 2848 cmd.exe 37 PID 2848 wrote to memory of 2784 2848 cmd.exe 37 PID 2848 wrote to memory of 2784 2848 cmd.exe 37 PID 2848 wrote to memory of 2420 2848 cmd.exe 38 PID 2848 wrote to memory of 2420 2848 cmd.exe 38 PID 2848 wrote to memory of 2420 2848 cmd.exe 38 PID 2848 wrote to memory of 1340 2848 cmd.exe 39 PID 2848 wrote to memory of 1340 2848 cmd.exe 39 PID 2848 wrote to memory of 1340 2848 cmd.exe 39 PID 2848 wrote to memory of 2736 2848 cmd.exe 40 PID 2848 wrote to memory of 2736 2848 cmd.exe 40 PID 2848 wrote to memory of 2736 2848 cmd.exe 40 PID 2736 wrote to memory of 2788 2736 cmd.exe 41 PID 2736 wrote to memory of 2788 2736 cmd.exe 41 PID 2736 wrote to memory of 2788 2736 cmd.exe 41 PID 2736 wrote to memory of 2708 2736 cmd.exe 42 PID 2736 wrote to memory of 2708 2736 cmd.exe 42 PID 2736 wrote to memory of 2708 2736 cmd.exe 42 PID 2848 wrote to memory of 3016 2848 cmd.exe 43 PID 2848 wrote to memory of 3016 2848 cmd.exe 43 PID 2848 wrote to memory of 3016 2848 cmd.exe 43 PID 2848 wrote to memory of 2636 2848 cmd.exe 44 PID 2848 wrote to memory of 2636 2848 cmd.exe 44 PID 2848 wrote to memory of 2636 2848 cmd.exe 44 PID 2848 wrote to memory of 1088 2848 cmd.exe 45 PID 2848 wrote to memory of 1088 2848 cmd.exe 45 PID 2848 wrote to memory of 1088 2848 cmd.exe 45 PID 2848 wrote to memory of 2764 2848 cmd.exe 46 PID 2848 wrote to memory of 2764 2848 cmd.exe 46 PID 2848 wrote to memory of 2764 2848 cmd.exe 46 PID 2848 wrote to memory of 2716 2848 cmd.exe 47 PID 2848 wrote to memory of 2716 2848 cmd.exe 47 PID 2848 wrote to memory of 2716 2848 cmd.exe 47 PID 2716 wrote to memory of 2596 2716 cmd.exe 48 PID 2716 wrote to memory of 2596 2716 cmd.exe 48 PID 2716 wrote to memory of 2596 2716 cmd.exe 48 PID 2848 wrote to memory of 2564 2848 cmd.exe 49 PID 2848 wrote to memory of 2564 2848 cmd.exe 49 PID 2848 wrote to memory of 2564 2848 cmd.exe 49 PID 2848 wrote to memory of 2164 2848 cmd.exe 32 PID 2848 wrote to memory of 2164 2848 cmd.exe 32 PID 2848 wrote to memory of 2164 2848 cmd.exe 32 PID 2164 wrote to memory of 2656 2164 cmd.exe 33 PID 2164 wrote to memory of 2656 2164 cmd.exe 33 PID 2164 wrote to memory of 2656 2164 cmd.exe 33 PID 2164 wrote to memory of 2384 2164 cmd.exe 34 PID 2164 wrote to memory of 2384 2164 cmd.exe 34 PID 2164 wrote to memory of 2384 2164 cmd.exe 34 PID 2848 wrote to memory of 2796 2848 cmd.exe 36 PID 2848 wrote to memory of 2796 2848 cmd.exe 36 PID 2848 wrote to memory of 2796 2848 cmd.exe 36 PID 2848 wrote to memory of 2784 2848 cmd.exe 37
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\mac.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2384
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\072⤵PID:2796
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0072⤵PID:2784
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00072⤵PID:2420
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007 /v NetworkAddress /t REG_SZ /d 7E16987BB3E6 /f2⤵PID:1340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2708
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\072⤵PID:3016
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0072⤵PID:2636
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00072⤵PID:1088
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0007 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:2764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:2596
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Local Area Connection" disable2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2564
-