Overview
overview
10Static
static
10Perm Spoof...er.exe
windows11-21h2-x64
1Perm Spoof...on.dll
windows11-21h2-x64
1Perm Spoof...ec.dll
windows11-21h2-x64
1Perm Spoofer/bz2.dll
windows11-21h2-x64
1Perm Spoof...ed.exe
windows11-21h2-x64
1Perm Spoof...F2.bat
windows11-21h2-x64
5Perm Spoof...ck.exe
windows11-21h2-x64
1Perm Spoof...hk.sys
windows11-21h2-x64
1Perm Spoof...DF.bat
windows11-21h2-x64
1Perm Spoof...64.dll
windows11-21h2-x64
1Perm Spoof...64.dll
windows11-21h2-x64
1Perm Spoof...64.dll
windows11-21h2-x64
1Perm Spoof...sk.bat
windows11-21h2-x64
6Perm Spoof...ls.exe
windows11-21h2-x64
10Perm Spoof...4e.sys
windows11-21h2-x64
1Perm Spoof...ac.bat
windows11-21h2-x64
1Perm Spoof...ss.exe
windows11-21h2-x64
1Perm Spoof...64.exe
windows11-21h2-x64
1Perm Spoof...64.sys
windows11-21h2-x64
1Perm Spoof...pe.dll
windows11-21h2-x64
1Perm Spoof...16.dll
windows11-21h2-x64
1Perm Spoof...ed.exe
windows11-21h2-x64
1Perm Spoof...b1.dll
windows11-21h2-x64
1Analysis
-
max time kernel
1s -
max time network
12s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-10-2024 16:58
Behavioral task
behavioral1
Sample
Perm Spoofer/Perm Spoofer.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
Perm Spoofer/brotlicommon.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Perm Spoofer/brotlidec.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
Perm Spoofer/bz2.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Perm Spoofer/cracked.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
Perm Spoofer/dumped files/ASUSPDF2.bat
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
Perm Spoofer/dumped files/AsDeviceCheck.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
Perm Spoofer/dumped files/AsDeviceChk.sys
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
Perm Spoofer/dumped files/AsusPDF.bat
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
Perm Spoofer/dumped files/afuefix64.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Perm Spoofer/dumped files/amideefix64.dll
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
Perm Spoofer/dumped files/bootx64.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Perm Spoofer/dumped files/disk.bat
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
Perm Spoofer/dumped files/fixserials.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
Perm Spoofer/dumped files/iqvw64e.sys
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
Perm Spoofer/dumped files/mac.bat
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
Perm Spoofer/dumped files/tpmbypass.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
Perm Spoofer/dumped files/winxsrcsv64.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
Perm Spoofer/dumped files/winxsrcsv64.sys
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
Perm Spoofer/freetype.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
Perm Spoofer/libpng16.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
Perm Spoofer/non cracked.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
Perm Spoofer/zlib1.dll
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
Perm Spoofer/dumped files/mac.bat
-
Size
1KB
-
MD5
707c798832f76eb383a0501b2773ec32
-
SHA1
3ebd0413af9929109ea0eb0045a2d26a256e771f
-
SHA256
940f3e68e62ad73c0668e854d821d88eacc8ea8fb8e130e42a34368ae9f5852e
-
SHA512
13e92ef958cfcc5686a2886b4a011f2287ec261028db0c6816d738eb715490d69ca37f8232e7bb3bebd5d49ce65bf4b9f55ae12d4af056bf569e5a1dba2f3da9
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3708 WMIC.exe Token: SeSecurityPrivilege 3708 WMIC.exe Token: SeTakeOwnershipPrivilege 3708 WMIC.exe Token: SeLoadDriverPrivilege 3708 WMIC.exe Token: SeSystemProfilePrivilege 3708 WMIC.exe Token: SeSystemtimePrivilege 3708 WMIC.exe Token: SeProfSingleProcessPrivilege 3708 WMIC.exe Token: SeIncBasePriorityPrivilege 3708 WMIC.exe Token: SeCreatePagefilePrivilege 3708 WMIC.exe Token: SeBackupPrivilege 3708 WMIC.exe Token: SeRestorePrivilege 3708 WMIC.exe Token: SeShutdownPrivilege 3708 WMIC.exe Token: SeDebugPrivilege 3708 WMIC.exe Token: SeSystemEnvironmentPrivilege 3708 WMIC.exe Token: SeRemoteShutdownPrivilege 3708 WMIC.exe Token: SeUndockPrivilege 3708 WMIC.exe Token: SeManageVolumePrivilege 3708 WMIC.exe Token: 33 3708 WMIC.exe Token: 34 3708 WMIC.exe Token: 35 3708 WMIC.exe Token: 36 3708 WMIC.exe Token: SeIncreaseQuotaPrivilege 3708 WMIC.exe Token: SeSecurityPrivilege 3708 WMIC.exe Token: SeTakeOwnershipPrivilege 3708 WMIC.exe Token: SeLoadDriverPrivilege 3708 WMIC.exe Token: SeSystemProfilePrivilege 3708 WMIC.exe Token: SeSystemtimePrivilege 3708 WMIC.exe Token: SeProfSingleProcessPrivilege 3708 WMIC.exe Token: SeIncBasePriorityPrivilege 3708 WMIC.exe Token: SeCreatePagefilePrivilege 3708 WMIC.exe Token: SeBackupPrivilege 3708 WMIC.exe Token: SeRestorePrivilege 3708 WMIC.exe Token: SeShutdownPrivilege 3708 WMIC.exe Token: SeDebugPrivilege 3708 WMIC.exe Token: SeSystemEnvironmentPrivilege 3708 WMIC.exe Token: SeRemoteShutdownPrivilege 3708 WMIC.exe Token: SeUndockPrivilege 3708 WMIC.exe Token: SeManageVolumePrivilege 3708 WMIC.exe Token: 33 3708 WMIC.exe Token: 34 3708 WMIC.exe Token: 35 3708 WMIC.exe Token: 36 3708 WMIC.exe Token: SeIncreaseQuotaPrivilege 1340 WMIC.exe Token: SeSecurityPrivilege 1340 WMIC.exe Token: SeTakeOwnershipPrivilege 1340 WMIC.exe Token: SeLoadDriverPrivilege 1340 WMIC.exe Token: SeSystemProfilePrivilege 1340 WMIC.exe Token: SeSystemtimePrivilege 1340 WMIC.exe Token: SeProfSingleProcessPrivilege 1340 WMIC.exe Token: SeIncBasePriorityPrivilege 1340 WMIC.exe Token: SeCreatePagefilePrivilege 1340 WMIC.exe Token: SeBackupPrivilege 1340 WMIC.exe Token: SeRestorePrivilege 1340 WMIC.exe Token: SeShutdownPrivilege 1340 WMIC.exe Token: SeDebugPrivilege 1340 WMIC.exe Token: SeSystemEnvironmentPrivilege 1340 WMIC.exe Token: SeRemoteShutdownPrivilege 1340 WMIC.exe Token: SeUndockPrivilege 1340 WMIC.exe Token: SeManageVolumePrivilege 1340 WMIC.exe Token: 33 1340 WMIC.exe Token: 34 1340 WMIC.exe Token: 35 1340 WMIC.exe Token: 36 1340 WMIC.exe Token: SeIncreaseQuotaPrivilege 1340 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1836 2368 cmd.exe 78 PID 2368 wrote to memory of 1836 2368 cmd.exe 78 PID 1836 wrote to memory of 3708 1836 cmd.exe 79 PID 1836 wrote to memory of 3708 1836 cmd.exe 79 PID 1836 wrote to memory of 3928 1836 cmd.exe 80 PID 1836 wrote to memory of 3928 1836 cmd.exe 80 PID 2368 wrote to memory of 2692 2368 cmd.exe 82 PID 2368 wrote to memory of 2692 2368 cmd.exe 82 PID 2368 wrote to memory of 8 2368 cmd.exe 83 PID 2368 wrote to memory of 8 2368 cmd.exe 83 PID 2368 wrote to memory of 4700 2368 cmd.exe 84 PID 2368 wrote to memory of 4700 2368 cmd.exe 84 PID 2368 wrote to memory of 3404 2368 cmd.exe 85 PID 2368 wrote to memory of 3404 2368 cmd.exe 85 PID 2368 wrote to memory of 4472 2368 cmd.exe 86 PID 2368 wrote to memory of 4472 2368 cmd.exe 86 PID 4472 wrote to memory of 1340 4472 cmd.exe 87 PID 4472 wrote to memory of 1340 4472 cmd.exe 87 PID 4472 wrote to memory of 580 4472 cmd.exe 88 PID 4472 wrote to memory of 580 4472 cmd.exe 88 PID 2368 wrote to memory of 3024 2368 cmd.exe 89 PID 2368 wrote to memory of 3024 2368 cmd.exe 89 PID 2368 wrote to memory of 2476 2368 cmd.exe 90 PID 2368 wrote to memory of 2476 2368 cmd.exe 90 PID 2368 wrote to memory of 2976 2368 cmd.exe 91 PID 2368 wrote to memory of 2976 2368 cmd.exe 91 PID 2368 wrote to memory of 3436 2368 cmd.exe 92 PID 2368 wrote to memory of 3436 2368 cmd.exe 92 PID 2368 wrote to memory of 3616 2368 cmd.exe 93 PID 2368 wrote to memory of 3616 2368 cmd.exe 93 PID 3616 wrote to memory of 1120 3616 cmd.exe 94 PID 3616 wrote to memory of 1120 3616 cmd.exe 94 PID 2368 wrote to memory of 2876 2368 cmd.exe 95 PID 2368 wrote to memory of 2876 2368 cmd.exe 95 PID 2368 wrote to memory of 1836 2368 cmd.exe 78 PID 2368 wrote to memory of 1836 2368 cmd.exe 78 PID 1836 wrote to memory of 3708 1836 cmd.exe 79 PID 1836 wrote to memory of 3708 1836 cmd.exe 79 PID 1836 wrote to memory of 3928 1836 cmd.exe 80 PID 1836 wrote to memory of 3928 1836 cmd.exe 80 PID 2368 wrote to memory of 2692 2368 cmd.exe 82 PID 2368 wrote to memory of 2692 2368 cmd.exe 82 PID 2368 wrote to memory of 8 2368 cmd.exe 83 PID 2368 wrote to memory of 8 2368 cmd.exe 83 PID 2368 wrote to memory of 4700 2368 cmd.exe 84 PID 2368 wrote to memory of 4700 2368 cmd.exe 84 PID 2368 wrote to memory of 3404 2368 cmd.exe 85 PID 2368 wrote to memory of 3404 2368 cmd.exe 85 PID 2368 wrote to memory of 4472 2368 cmd.exe 86 PID 2368 wrote to memory of 4472 2368 cmd.exe 86 PID 4472 wrote to memory of 1340 4472 cmd.exe 87 PID 4472 wrote to memory of 1340 4472 cmd.exe 87 PID 4472 wrote to memory of 580 4472 cmd.exe 88 PID 4472 wrote to memory of 580 4472 cmd.exe 88 PID 2368 wrote to memory of 3024 2368 cmd.exe 89 PID 2368 wrote to memory of 3024 2368 cmd.exe 89 PID 2368 wrote to memory of 2476 2368 cmd.exe 90 PID 2368 wrote to memory of 2476 2368 cmd.exe 90 PID 2368 wrote to memory of 2976 2368 cmd.exe 91 PID 2368 wrote to memory of 2976 2368 cmd.exe 91 PID 2368 wrote to memory of 3436 2368 cmd.exe 92 PID 2368 wrote to memory of 3436 2368 cmd.exe 92 PID 2368 wrote to memory of 3616 2368 cmd.exe 93 PID 2368 wrote to memory of 3616 2368 cmd.exe 93
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\mac.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:3928
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:2692
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:8
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:4700
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d E6FF7B86FA6C /f2⤵PID:3404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:580
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:3024
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:2476
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:2976
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:3436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:1120
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable2⤵PID:2876
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:1304