b4b6f0ce548f5ec6207bf0f8350011f953ef5d4011ff288ef5e2e0376cc18ded

Analysis

max time kernel
1s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Perm Spoofer/dumped files/mac.bat
Size

1KB
MD5

707c798832f76eb383a0501b2773ec32
SHA1

3ebd0413af9929109ea0eb0045a2d26a256e771f
SHA256

940f3e68e62ad73c0668e854d821d88eacc8ea8fb8e130e42a34368ae9f5852e
SHA512

13e92ef958cfcc5686a2886b4a011f2287ec261028db0c6816d738eb715490d69ca37f8232e7bb3bebd5d49ce65bf4b9f55ae12d4af056bf569e5a1dba2f3da9

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	520	WMIC.exe
Token: SeSecurityPrivilege	520	WMIC.exe
Token: SeTakeOwnershipPrivilege	520	WMIC.exe
Token: SeLoadDriverPrivilege	520	WMIC.exe
Token: SeSystemProfilePrivilege	520	WMIC.exe
Token: SeSystemtimePrivilege	520	WMIC.exe
Token: SeProfSingleProcessPrivilege	520	WMIC.exe
Token: SeIncBasePriorityPrivilege	520	WMIC.exe
Token: SeCreatePagefilePrivilege	520	WMIC.exe
Token: SeBackupPrivilege	520	WMIC.exe
Token: SeRestorePrivilege	520	WMIC.exe
Token: SeShutdownPrivilege	520	WMIC.exe
Token: SeDebugPrivilege	520	WMIC.exe
Token: SeSystemEnvironmentPrivilege	520	WMIC.exe
Token: SeRemoteShutdownPrivilege	520	WMIC.exe
Token: SeUndockPrivilege	520	WMIC.exe
Token: SeManageVolumePrivilege	520	WMIC.exe
Token: 33	520	WMIC.exe
Token: 34	520	WMIC.exe
Token: 35	520	WMIC.exe
Token: 36	520	WMIC.exe
Token: SeIncreaseQuotaPrivilege	520	WMIC.exe
Token: SeSecurityPrivilege	520	WMIC.exe
Token: SeTakeOwnershipPrivilege	520	WMIC.exe
Token: SeLoadDriverPrivilege	520	WMIC.exe
Token: SeSystemProfilePrivilege	520	WMIC.exe
Token: SeSystemtimePrivilege	520	WMIC.exe
Token: SeProfSingleProcessPrivilege	520	WMIC.exe
Token: SeIncBasePriorityPrivilege	520	WMIC.exe
Token: SeCreatePagefilePrivilege	520	WMIC.exe
Token: SeBackupPrivilege	520	WMIC.exe
Token: SeRestorePrivilege	520	WMIC.exe
Token: SeShutdownPrivilege	520	WMIC.exe
Token: SeDebugPrivilege	520	WMIC.exe
Token: SeSystemEnvironmentPrivilege	520	WMIC.exe
Token: SeRemoteShutdownPrivilege	520	WMIC.exe
Token: SeUndockPrivilege	520	WMIC.exe
Token: SeManageVolumePrivilege	520	WMIC.exe
Token: 33	520	WMIC.exe
Token: 34	520	WMIC.exe
Token: 35	520	WMIC.exe
Token: 36	520	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2764	WMIC.exe
Token: SeSecurityPrivilege	2764	WMIC.exe
Token: SeTakeOwnershipPrivilege	2764	WMIC.exe
Token: SeLoadDriverPrivilege	2764	WMIC.exe
Token: SeSystemProfilePrivilege	2764	WMIC.exe
Token: SeSystemtimePrivilege	2764	WMIC.exe
Token: SeProfSingleProcessPrivilege	2764	WMIC.exe
Token: SeIncBasePriorityPrivilege	2764	WMIC.exe
Token: SeCreatePagefilePrivilege	2764	WMIC.exe
Token: SeBackupPrivilege	2764	WMIC.exe
Token: SeRestorePrivilege	2764	WMIC.exe
Token: SeShutdownPrivilege	2764	WMIC.exe
Token: SeDebugPrivilege	2764	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2764	WMIC.exe
Token: SeRemoteShutdownPrivilege	2764	WMIC.exe
Token: SeUndockPrivilege	2764	WMIC.exe
Token: SeManageVolumePrivilege	2764	WMIC.exe
Token: 33	2764	WMIC.exe
Token: 34	2764	WMIC.exe
Token: 35	2764	WMIC.exe
Token: 36	2764	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2764	WMIC.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

cmd.execmd.execmd.exe

description	pid	process	target process
PID 4648 wrote to memory of 956	4648	cmd.exe	cmd.exe
PID 4648 wrote to memory of 956	4648	cmd.exe	cmd.exe
PID 956 wrote to memory of 520	956	cmd.exe	WMIC.exe
PID 956 wrote to memory of 520	956	cmd.exe	WMIC.exe
PID 956 wrote to memory of 436	956	cmd.exe	findstr.exe
PID 956 wrote to memory of 436	956	cmd.exe	findstr.exe
PID 4648 wrote to memory of 4656	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4656	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4932	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4932	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 3568	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 3568	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2124	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2124	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4576	4648	cmd.exe	cmd.exe
PID 4648 wrote to memory of 4576	4648	cmd.exe	cmd.exe
PID 4576 wrote to memory of 2764	4576	cmd.exe	WMIC.exe
PID 4576 wrote to memory of 2764	4576	cmd.exe	WMIC.exe
PID 4576 wrote to memory of 1140	4576	cmd.exe	findstr.exe
PID 4576 wrote to memory of 1140	4576	cmd.exe	findstr.exe
PID 4648 wrote to memory of 1976	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 1976	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4408	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4408	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2468	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2468	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2364	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2364	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4164	4648	cmd.exe	cmd.exe
PID 4648 wrote to memory of 4164	4648	cmd.exe	cmd.exe
PID 4648 wrote to memory of 956	4648	cmd.exe	cmd.exe
PID 4648 wrote to memory of 956	4648	cmd.exe	cmd.exe
PID 956 wrote to memory of 520	956	cmd.exe	WMIC.exe
PID 956 wrote to memory of 520	956	cmd.exe	WMIC.exe
PID 956 wrote to memory of 436	956	cmd.exe	findstr.exe
PID 956 wrote to memory of 436	956	cmd.exe	findstr.exe
PID 4648 wrote to memory of 4656	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4656	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4932	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4932	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 3568	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 3568	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2124	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2124	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4576	4648	cmd.exe	cmd.exe
PID 4648 wrote to memory of 4576	4648	cmd.exe	cmd.exe
PID 4576 wrote to memory of 2764	4576	cmd.exe	WMIC.exe
PID 4576 wrote to memory of 2764	4576	cmd.exe	WMIC.exe
PID 4576 wrote to memory of 1140	4576	cmd.exe	findstr.exe
PID 4576 wrote to memory of 1140	4576	cmd.exe	findstr.exe
PID 4648 wrote to memory of 1976	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 1976	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4408	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4408	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2468	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2468	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2364	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2364	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 4164	4648	cmd.exe	cmd.exe
PID 4648 wrote to memory of 4164	4648	cmd.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Perm Spoofer\dumped files\mac.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:520
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:436
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:4932
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d CA3B0AC39F69 /f
  2⤵
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where physicaladapter=true get deviceid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\system32\findstr.exe
    findstr [0-9]
    3⤵
    PID:1140
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
  2⤵
  PID:1976
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
  2⤵
  PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
  2⤵
  PID:4164
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
    3⤵
    PID:3824
- C:\Windows\system32\netsh.exe
  netsh interface set interface name="Ethernet" disable
  2⤵
  PID:5052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:4248

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads