Overview
overview
7Static
static
5Timrex Per.../1.exe
windows10-2004-x64
7Timrex Per.../2.exe
windows10-2004-x64
7Timrex Per.../3.exe
windows10-2004-x64
7Timrex Per...rm.exe
windows10-2004-x64
6Timrex Per...ls.bat
windows10-2004-x64
1Timrex Per...n].bat
windows10-2004-x64
1Timrex Per...gs.vbs
windows10-2004-x64
1Timrex Per...ol.exe
windows10-2004-x64
5Analysis
-
max time kernel
42s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2025 11:35
Behavioral task
behavioral1
Sample
Timrex Perm/Timrex Perm/Download this first/1.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Timrex Perm/Timrex Perm/Download this first/2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Timrex Perm/Timrex Perm/Download this first/3.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Timrex Perm/Timrex Perm/Perm.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Timrex Perm/Timrex Perm/Serial checker/Timrex Serials.bat
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Timrex Perm/Timrex Perm/Wifi & Bluetooth disabler/Disabler [Run Admin].bat
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Timrex Perm/Timrex Perm/defender control/Defender_Settings.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Timrex Perm/Timrex Perm/Serial checker/Timrex Serials.bat
-
Size
1KB
-
MD5
61642a48b84b0f8468ee36cf53cd07d8
-
SHA1
87117498362cb37d3cbdd2db9894f4d85a445dcd
-
SHA256
a1bea8a38f623f883dacbf4793c307d7a8347715a796ac93332cb3afb8188b6d
-
SHA512
3e1be534f810e87fa917f26e7797ef6adb3ec3c5572f6f1c74650449dbf22cd6bd4f6c39c4bab1ef1b13a4a67da9f0e461c6ec308cc1e55b8027d9830723271a
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3476 WMIC.exe Token: SeSecurityPrivilege 3476 WMIC.exe Token: SeTakeOwnershipPrivilege 3476 WMIC.exe Token: SeLoadDriverPrivilege 3476 WMIC.exe Token: SeSystemProfilePrivilege 3476 WMIC.exe Token: SeSystemtimePrivilege 3476 WMIC.exe Token: SeProfSingleProcessPrivilege 3476 WMIC.exe Token: SeIncBasePriorityPrivilege 3476 WMIC.exe Token: SeCreatePagefilePrivilege 3476 WMIC.exe Token: SeBackupPrivilege 3476 WMIC.exe Token: SeRestorePrivilege 3476 WMIC.exe Token: SeShutdownPrivilege 3476 WMIC.exe Token: SeDebugPrivilege 3476 WMIC.exe Token: SeSystemEnvironmentPrivilege 3476 WMIC.exe Token: SeRemoteShutdownPrivilege 3476 WMIC.exe Token: SeUndockPrivilege 3476 WMIC.exe Token: SeManageVolumePrivilege 3476 WMIC.exe Token: 33 3476 WMIC.exe Token: 34 3476 WMIC.exe Token: 35 3476 WMIC.exe Token: 36 3476 WMIC.exe Token: SeIncreaseQuotaPrivilege 3476 WMIC.exe Token: SeSecurityPrivilege 3476 WMIC.exe Token: SeTakeOwnershipPrivilege 3476 WMIC.exe Token: SeLoadDriverPrivilege 3476 WMIC.exe Token: SeSystemProfilePrivilege 3476 WMIC.exe Token: SeSystemtimePrivilege 3476 WMIC.exe Token: SeProfSingleProcessPrivilege 3476 WMIC.exe Token: SeIncBasePriorityPrivilege 3476 WMIC.exe Token: SeCreatePagefilePrivilege 3476 WMIC.exe Token: SeBackupPrivilege 3476 WMIC.exe Token: SeRestorePrivilege 3476 WMIC.exe Token: SeShutdownPrivilege 3476 WMIC.exe Token: SeDebugPrivilege 3476 WMIC.exe Token: SeSystemEnvironmentPrivilege 3476 WMIC.exe Token: SeRemoteShutdownPrivilege 3476 WMIC.exe Token: SeUndockPrivilege 3476 WMIC.exe Token: SeManageVolumePrivilege 3476 WMIC.exe Token: 33 3476 WMIC.exe Token: 34 3476 WMIC.exe Token: 35 3476 WMIC.exe Token: 36 3476 WMIC.exe Token: SeIncreaseQuotaPrivilege 4316 WMIC.exe Token: SeSecurityPrivilege 4316 WMIC.exe Token: SeTakeOwnershipPrivilege 4316 WMIC.exe Token: SeLoadDriverPrivilege 4316 WMIC.exe Token: SeSystemProfilePrivilege 4316 WMIC.exe Token: SeSystemtimePrivilege 4316 WMIC.exe Token: SeProfSingleProcessPrivilege 4316 WMIC.exe Token: SeIncBasePriorityPrivilege 4316 WMIC.exe Token: SeCreatePagefilePrivilege 4316 WMIC.exe Token: SeBackupPrivilege 4316 WMIC.exe Token: SeRestorePrivilege 4316 WMIC.exe Token: SeShutdownPrivilege 4316 WMIC.exe Token: SeDebugPrivilege 4316 WMIC.exe Token: SeSystemEnvironmentPrivilege 4316 WMIC.exe Token: SeRemoteShutdownPrivilege 4316 WMIC.exe Token: SeUndockPrivilege 4316 WMIC.exe Token: SeManageVolumePrivilege 4316 WMIC.exe Token: 33 4316 WMIC.exe Token: 34 4316 WMIC.exe Token: 35 4316 WMIC.exe Token: 36 4316 WMIC.exe Token: SeIncreaseQuotaPrivilege 4316 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3504 wrote to memory of 3476 3504 cmd.exe 86 PID 3504 wrote to memory of 3476 3504 cmd.exe 86 PID 3504 wrote to memory of 4316 3504 cmd.exe 88 PID 3504 wrote to memory of 4316 3504 cmd.exe 88 PID 3504 wrote to memory of 1284 3504 cmd.exe 90 PID 3504 wrote to memory of 1284 3504 cmd.exe 90 PID 3504 wrote to memory of 2100 3504 cmd.exe 91 PID 3504 wrote to memory of 2100 3504 cmd.exe 91 PID 3504 wrote to memory of 4572 3504 cmd.exe 92 PID 3504 wrote to memory of 4572 3504 cmd.exe 92 PID 3504 wrote to memory of 1524 3504 cmd.exe 93 PID 3504 wrote to memory of 1524 3504 cmd.exe 93 PID 3504 wrote to memory of 3120 3504 cmd.exe 94 PID 3504 wrote to memory of 3120 3504 cmd.exe 94 PID 3504 wrote to memory of 936 3504 cmd.exe 95 PID 3504 wrote to memory of 936 3504 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Timrex Perm\Timrex Perm\Serial checker\Timrex Serials.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\System32\Wbem\WMIC.exewmic systemenclosure get serialnumber2⤵PID:1284
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid2⤵PID:2100
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber2⤵PID:4572
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber2⤵PID:1524
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductID2⤵PID:3120
-
-
C:\Windows\system32\getmac.exegetmac2⤵PID:936
-