b4b6f0ce548f5ec6207bf0f8350011f953ef5d4011ff288ef5e2e0376cc18ded

Analysis

max time kernel
1s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Perm Spoofer/dumped files/mac.bat
Size

1KB
MD5

707c798832f76eb383a0501b2773ec32
SHA1

3ebd0413af9929109ea0eb0045a2d26a256e771f
SHA256

940f3e68e62ad73c0668e854d821d88eacc8ea8fb8e130e42a34368ae9f5852e
SHA512

13e92ef958cfcc5686a2886b4a011f2287ec261028db0c6816d738eb715490d69ca37f8232e7bb3bebd5d49ce65bf4b9f55ae12d4af056bf569e5a1dba2f3da9

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3068	WMIC.exe
Token: SeSecurityPrivilege	3068	WMIC.exe
Token: SeTakeOwnershipPrivilege	3068	WMIC.exe
Token: SeLoadDriverPrivilege	3068	WMIC.exe
Token: SeSystemProfilePrivilege	3068	WMIC.exe
Token: SeSystemtimePrivilege	3068	WMIC.exe
Token: SeProfSingleProcessPrivilege	3068	WMIC.exe
Token: SeIncBasePriorityPrivilege	3068	WMIC.exe
Token: SeCreatePagefilePrivilege	3068	WMIC.exe
Token: SeBackupPrivilege	3068	WMIC.exe
Token: SeRestorePrivilege	3068	WMIC.exe
Token: SeShutdownPrivilege	3068	WMIC.exe
Token: SeDebugPrivilege	3068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3068	WMIC.exe
Token: SeRemoteShutdownPrivilege	3068	WMIC.exe
Token: SeUndockPrivilege	3068	WMIC.exe
Token: SeManageVolumePrivilege	3068	WMIC.exe
Token: 33	3068	WMIC.exe
Token: 34	3068	WMIC.exe
Token: 35	3068	WMIC.exe
Token: 36	3068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3068	WMIC.exe
Token: SeSecurityPrivilege	3068	WMIC.exe
Token: SeTakeOwnershipPrivilege	3068	WMIC.exe
Token: SeLoadDriverPrivilege	3068	WMIC.exe
Token: SeSystemProfilePrivilege	3068	WMIC.exe
Token: SeSystemtimePrivilege	3068	WMIC.exe
Token: SeProfSingleProcessPrivilege	3068	WMIC.exe
Token: SeIncBasePriorityPrivilege	3068	WMIC.exe
Token: SeCreatePagefilePrivilege	3068	WMIC.exe
Token: SeBackupPrivilege	3068	WMIC.exe
Token: SeRestorePrivilege	3068	WMIC.exe
Token: SeShutdownPrivilege	3068	WMIC.exe
Token: SeDebugPrivilege	3068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3068	WMIC.exe
Token: SeRemoteShutdownPrivilege	3068	WMIC.exe
Token: SeUndockPrivilege	3068	WMIC.exe
Token: SeManageVolumePrivilege	3068	WMIC.exe
Token: 33	3068	WMIC.exe
Token: 34	3068	WMIC.exe
Token: 35	3068	WMIC.exe
Token: 36	3068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4152	WMIC.exe
Token: SeSecurityPrivilege	4152	WMIC.exe
Token: SeTakeOwnershipPrivilege	4152	WMIC.exe
Token: SeLoadDriverPrivilege	4152	WMIC.exe
Token: SeSystemProfilePrivilege	4152	WMIC.exe
Token: SeSystemtimePrivilege	4152	WMIC.exe
Token: SeProfSingleProcessPrivilege	4152	WMIC.exe
Token: SeIncBasePriorityPrivilege	4152	WMIC.exe
Token: SeCreatePagefilePrivilege	4152	WMIC.exe
Token: SeBackupPrivilege	4152	WMIC.exe
Token: SeRestorePrivilege	4152	WMIC.exe
Token: SeShutdownPrivilege	4152	WMIC.exe
Token: SeDebugPrivilege	4152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4152	WMIC.exe
Token: SeRemoteShutdownPrivilege	4152	WMIC.exe
Token: SeUndockPrivilege	4152	WMIC.exe
Token: SeManageVolumePrivilege	4152	WMIC.exe
Token: 33	4152	WMIC.exe
Token: 34	4152	WMIC.exe
Token: 35	4152	WMIC.exe
Token: 36	4152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4152	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2896 wrote to memory of 3352	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 3352	2896	cmd.exe	cmd.exe
PID 3352 wrote to memory of 3068	3352	cmd.exe	WMIC.exe
PID 3352 wrote to memory of 3068	3352	cmd.exe	WMIC.exe
PID 3352 wrote to memory of 3568	3352	cmd.exe	findstr.exe
PID 3352 wrote to memory of 3568	3352	cmd.exe	findstr.exe
PID 2896 wrote to memory of 1556	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1556	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 456	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 456	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 2596	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 2596	2896	cmd.exe	cmd.exe
PID 2596 wrote to memory of 4152	2596	cmd.exe	WMIC.exe
PID 2596 wrote to memory of 4152	2596	cmd.exe	WMIC.exe
PID 2596 wrote to memory of 2652	2596	cmd.exe	findstr.exe
PID 2596 wrote to memory of 2652	2596	cmd.exe	findstr.exe
PID 2896 wrote to memory of 4304	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4304	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 2144	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 2144	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1484	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1484	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 3644	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 3644	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4708	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 4708	2896	cmd.exe	cmd.exe
PID 4708 wrote to memory of 4100	4708	cmd.exe	WMIC.exe
PID 4708 wrote to memory of 4100	4708	cmd.exe	WMIC.exe
PID 2896 wrote to memory of 1308	2896	cmd.exe	netsh.exe
PID 2896 wrote to memory of 1308	2896	cmd.exe	netsh.exe
PID 2896 wrote to memory of 3352	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 3352	2896	cmd.exe	cmd.exe
PID 3352 wrote to memory of 3068	3352	cmd.exe	WMIC.exe
PID 3352 wrote to memory of 3068	3352	cmd.exe	WMIC.exe
PID 3352 wrote to memory of 3568	3352	cmd.exe	findstr.exe
PID 3352 wrote to memory of 3568	3352	cmd.exe	findstr.exe
PID 2896 wrote to memory of 1556	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1556	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 456	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 456	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4916	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 2596	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 2596	2896	cmd.exe	cmd.exe
PID 2596 wrote to memory of 4152	2596	cmd.exe	WMIC.exe
PID 2596 wrote to memory of 4152	2596	cmd.exe	WMIC.exe
PID 2596 wrote to memory of 2652	2596	cmd.exe	findstr.exe
PID 2596 wrote to memory of 2652	2596	cmd.exe	findstr.exe
PID 2896 wrote to memory of 4304	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4304	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 2144	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 2144	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1484	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 1484	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 3644	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 3644	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 4708	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 4708	2896	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\mac.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:3568
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:1556
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:1916
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:456
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 0A184A69CB6E /f
  2⤵
  PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:2652
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:4304
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:2144
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:1484
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
  2⤵
  PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
    3⤵
    PID:4100
- C:\Windows\system32\netsh.exe
  netsh interface set interface name="Ethernet" disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads