b4b6f0ce548f5ec6207bf0f8350011f953ef5d4011ff288ef5e2e0376cc18ded

Resubmissions

13-11-2024 20:39

241113-zfjhksygpp 10

Analysis

max time kernel
1s
max time network
14s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
13-11-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Perm Spoofer/dumped files/mac.bat
Size

1KB
MD5

707c798832f76eb383a0501b2773ec32
SHA1

3ebd0413af9929109ea0eb0045a2d26a256e771f
SHA256

940f3e68e62ad73c0668e854d821d88eacc8ea8fb8e130e42a34368ae9f5852e
SHA512

13e92ef958cfcc5686a2886b4a011f2287ec261028db0c6816d738eb715490d69ca37f8232e7bb3bebd5d49ce65bf4b9f55ae12d4af056bf569e5a1dba2f3da9

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	416	WMIC.exe
Token: SeSecurityPrivilege	416	WMIC.exe
Token: SeTakeOwnershipPrivilege	416	WMIC.exe
Token: SeLoadDriverPrivilege	416	WMIC.exe
Token: SeSystemProfilePrivilege	416	WMIC.exe
Token: SeSystemtimePrivilege	416	WMIC.exe
Token: SeProfSingleProcessPrivilege	416	WMIC.exe
Token: SeIncBasePriorityPrivilege	416	WMIC.exe
Token: SeCreatePagefilePrivilege	416	WMIC.exe
Token: SeBackupPrivilege	416	WMIC.exe
Token: SeRestorePrivilege	416	WMIC.exe
Token: SeShutdownPrivilege	416	WMIC.exe
Token: SeDebugPrivilege	416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	416	WMIC.exe
Token: SeRemoteShutdownPrivilege	416	WMIC.exe
Token: SeUndockPrivilege	416	WMIC.exe
Token: SeManageVolumePrivilege	416	WMIC.exe
Token: 33	416	WMIC.exe
Token: 34	416	WMIC.exe
Token: 35	416	WMIC.exe
Token: 36	416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	416	WMIC.exe
Token: SeSecurityPrivilege	416	WMIC.exe
Token: SeTakeOwnershipPrivilege	416	WMIC.exe
Token: SeLoadDriverPrivilege	416	WMIC.exe
Token: SeSystemProfilePrivilege	416	WMIC.exe
Token: SeSystemtimePrivilege	416	WMIC.exe
Token: SeProfSingleProcessPrivilege	416	WMIC.exe
Token: SeIncBasePriorityPrivilege	416	WMIC.exe
Token: SeCreatePagefilePrivilege	416	WMIC.exe
Token: SeBackupPrivilege	416	WMIC.exe
Token: SeRestorePrivilege	416	WMIC.exe
Token: SeShutdownPrivilege	416	WMIC.exe
Token: SeDebugPrivilege	416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	416	WMIC.exe
Token: SeRemoteShutdownPrivilege	416	WMIC.exe
Token: SeUndockPrivilege	416	WMIC.exe
Token: SeManageVolumePrivilege	416	WMIC.exe
Token: 33	416	WMIC.exe
Token: 34	416	WMIC.exe
Token: 35	416	WMIC.exe
Token: 36	416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4756	WMIC.exe
Token: SeSecurityPrivilege	4756	WMIC.exe
Token: SeTakeOwnershipPrivilege	4756	WMIC.exe
Token: SeLoadDriverPrivilege	4756	WMIC.exe
Token: SeSystemProfilePrivilege	4756	WMIC.exe
Token: SeSystemtimePrivilege	4756	WMIC.exe
Token: SeProfSingleProcessPrivilege	4756	WMIC.exe
Token: SeIncBasePriorityPrivilege	4756	WMIC.exe
Token: SeCreatePagefilePrivilege	4756	WMIC.exe
Token: SeBackupPrivilege	4756	WMIC.exe
Token: SeRestorePrivilege	4756	WMIC.exe
Token: SeShutdownPrivilege	4756	WMIC.exe
Token: SeDebugPrivilege	4756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4756	WMIC.exe
Token: SeRemoteShutdownPrivilege	4756	WMIC.exe
Token: SeUndockPrivilege	4756	WMIC.exe
Token: SeManageVolumePrivilege	4756	WMIC.exe
Token: 33	4756	WMIC.exe
Token: 34	4756	WMIC.exe
Token: 35	4756	WMIC.exe
Token: 36	4756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4756	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3100 wrote to memory of 4828	3100	cmd.exe	cmd.exe
PID 3100 wrote to memory of 4828	3100	cmd.exe	cmd.exe
PID 4828 wrote to memory of 416	4828	cmd.exe	WMIC.exe
PID 4828 wrote to memory of 416	4828	cmd.exe	WMIC.exe
PID 4828 wrote to memory of 872	4828	cmd.exe	findstr.exe
PID 4828 wrote to memory of 872	4828	cmd.exe	findstr.exe
PID 3100 wrote to memory of 252	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 252	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1784	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1784	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3468	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3468	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1300	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1300	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 4444	3100	cmd.exe	cmd.exe
PID 3100 wrote to memory of 4444	3100	cmd.exe	cmd.exe
PID 4444 wrote to memory of 4756	4444	cmd.exe	WMIC.exe
PID 4444 wrote to memory of 4756	4444	cmd.exe	WMIC.exe
PID 4444 wrote to memory of 2068	4444	cmd.exe	findstr.exe
PID 4444 wrote to memory of 2068	4444	cmd.exe	findstr.exe
PID 3100 wrote to memory of 1532	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1532	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3916	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3916	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 2836	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 2836	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1496	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1496	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 4220	3100	cmd.exe	cmd.exe
PID 3100 wrote to memory of 4220	3100	cmd.exe	cmd.exe
PID 4220 wrote to memory of 4248	4220	cmd.exe	WMIC.exe
PID 4220 wrote to memory of 4248	4220	cmd.exe	WMIC.exe
PID 3100 wrote to memory of 4828	3100	cmd.exe	cmd.exe
PID 3100 wrote to memory of 4828	3100	cmd.exe	cmd.exe
PID 4828 wrote to memory of 416	4828	cmd.exe	WMIC.exe
PID 4828 wrote to memory of 416	4828	cmd.exe	WMIC.exe
PID 4828 wrote to memory of 872	4828	cmd.exe	findstr.exe
PID 4828 wrote to memory of 872	4828	cmd.exe	findstr.exe
PID 3100 wrote to memory of 252	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 252	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1784	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1784	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3468	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3468	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1300	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1300	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 4444	3100	cmd.exe	cmd.exe
PID 3100 wrote to memory of 4444	3100	cmd.exe	cmd.exe
PID 4444 wrote to memory of 4756	4444	cmd.exe	WMIC.exe
PID 4444 wrote to memory of 4756	4444	cmd.exe	WMIC.exe
PID 4444 wrote to memory of 2068	4444	cmd.exe	findstr.exe
PID 4444 wrote to memory of 2068	4444	cmd.exe	findstr.exe
PID 3100 wrote to memory of 1532	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1532	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3916	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 3916	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 2836	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 2836	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1496	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 1496	3100	cmd.exe	reg.exe
PID 3100 wrote to memory of 4220	3100	cmd.exe	cmd.exe
PID 3100 wrote to memory of 4220	3100	cmd.exe	cmd.exe
PID 4220 wrote to memory of 4248	4220	cmd.exe	WMIC.exe
PID 4220 wrote to memory of 4248	4220	cmd.exe	WMIC.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\mac.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:872
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:252
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:1784
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 322E47E31236 /f
  2⤵
  PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:2068
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:2836
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
  2⤵
  PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
    3⤵
    PID:4248
- C:\Windows\system32\netsh.exe
  netsh interface set interface name="Ethernet" disable
  2⤵
  PID:4552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:3472

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads