Overview
overview
10Static
static
56GZ4B0XxJP...fg.exe
windows7-x64
36GZ4B0XxJP...fg.exe
windows10-2004-x64
16GZ4B0XxJP...ol.exe
windows7-x64
106GZ4B0XxJP...ol.exe
windows10-2004-x64
56GZ4B0XxJP...gs.vbs
windows7-x64
36GZ4B0XxJP...gs.vbs
windows10-2004-x64
16GZ4B0XxJP...ER.bat
windows7-x64
36GZ4B0XxJP...ER.bat
windows10-2004-x64
36GZ4B0XxJP...IO.exe
windows7-x64
76GZ4B0XxJP...IO.exe
windows10-2004-x64
76GZ4B0XxJP...up.exe
windows7-x64
76GZ4B0XxJP...up.exe
windows10-2004-x64
7Analysis
-
max time kernel
1s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2025 14:16
Behavioral task
behavioral1
Sample
6GZ4B0XxJPfg/6GZ4B0XxJPfg.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
6GZ4B0XxJPfg/6GZ4B0XxJPfg.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
6GZ4B0XxJPfg/Requirement/Defender Control/Defender Control.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
6GZ4B0XxJPfg/Requirement/Defender Control/Defender Control.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
6GZ4B0XxJPfg/Requirement/Defender Control/Defender_Settings.vbs
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
6GZ4B0XxJPfg/Requirement/Defender Control/Defender_Settings.vbs
Resource
win10v2004-20250217-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
6GZ4B0XxJPfg/Requirement/MAC CHANGER.bat
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
6GZ4B0XxJPfg/Requirement/MAC CHANGER.bat
Resource
win10v2004-20250217-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
6GZ4B0XxJPfg/Requirement/Visual C++ AIO.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral10
Sample
6GZ4B0XxJPfg/Requirement/Visual C++ AIO.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral11
Sample
6GZ4B0XxJPfg/Requirement/dxwebsetup.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral12
Sample
6GZ4B0XxJPfg/Requirement/dxwebsetup.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
6GZ4B0XxJPfg/Requirement/MAC CHANGER.bat
-
Size
2KB
-
MD5
86630f471a1c7f40e8494347f9ab8249
-
SHA1
10a2139adfb884f01799de89bf9b9ccb2a8bb460
-
SHA256
c15faade0e71acd4abcb60a7e9f3f002a46d3d47bd294f7b12d811c871d1292c
-
SHA512
666fe7866c2bedc78aad081bddf7e4dc8a9038b173527dc9464dd9c0776314a8c3e1ec7f4d0f34aff0d946b94ed1178a5c665d79173d1bfe0a0a611f6af65369
Score
3/10
Malware Config
Signatures
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2136 WMIC.exe Token: SeSecurityPrivilege 2136 WMIC.exe Token: SeTakeOwnershipPrivilege 2136 WMIC.exe Token: SeLoadDriverPrivilege 2136 WMIC.exe Token: SeSystemProfilePrivilege 2136 WMIC.exe Token: SeSystemtimePrivilege 2136 WMIC.exe Token: SeProfSingleProcessPrivilege 2136 WMIC.exe Token: SeIncBasePriorityPrivilege 2136 WMIC.exe Token: SeCreatePagefilePrivilege 2136 WMIC.exe Token: SeBackupPrivilege 2136 WMIC.exe Token: SeRestorePrivilege 2136 WMIC.exe Token: SeShutdownPrivilege 2136 WMIC.exe Token: SeDebugPrivilege 2136 WMIC.exe Token: SeSystemEnvironmentPrivilege 2136 WMIC.exe Token: SeRemoteShutdownPrivilege 2136 WMIC.exe Token: SeUndockPrivilege 2136 WMIC.exe Token: SeManageVolumePrivilege 2136 WMIC.exe Token: 33 2136 WMIC.exe Token: 34 2136 WMIC.exe Token: 35 2136 WMIC.exe Token: 36 2136 WMIC.exe Token: SeIncreaseQuotaPrivilege 2136 WMIC.exe Token: SeSecurityPrivilege 2136 WMIC.exe Token: SeTakeOwnershipPrivilege 2136 WMIC.exe Token: SeLoadDriverPrivilege 2136 WMIC.exe Token: SeSystemProfilePrivilege 2136 WMIC.exe Token: SeSystemtimePrivilege 2136 WMIC.exe Token: SeProfSingleProcessPrivilege 2136 WMIC.exe Token: SeIncBasePriorityPrivilege 2136 WMIC.exe Token: SeCreatePagefilePrivilege 2136 WMIC.exe Token: SeBackupPrivilege 2136 WMIC.exe Token: SeRestorePrivilege 2136 WMIC.exe Token: SeShutdownPrivilege 2136 WMIC.exe Token: SeDebugPrivilege 2136 WMIC.exe Token: SeSystemEnvironmentPrivilege 2136 WMIC.exe Token: SeRemoteShutdownPrivilege 2136 WMIC.exe Token: SeUndockPrivilege 2136 WMIC.exe Token: SeManageVolumePrivilege 2136 WMIC.exe Token: 33 2136 WMIC.exe Token: 34 2136 WMIC.exe Token: 35 2136 WMIC.exe Token: 36 2136 WMIC.exe Token: SeIncreaseQuotaPrivilege 32 WMIC.exe Token: SeSecurityPrivilege 32 WMIC.exe Token: SeTakeOwnershipPrivilege 32 WMIC.exe Token: SeLoadDriverPrivilege 32 WMIC.exe Token: SeSystemProfilePrivilege 32 WMIC.exe Token: SeSystemtimePrivilege 32 WMIC.exe Token: SeProfSingleProcessPrivilege 32 WMIC.exe Token: SeIncBasePriorityPrivilege 32 WMIC.exe Token: SeCreatePagefilePrivilege 32 WMIC.exe Token: SeBackupPrivilege 32 WMIC.exe Token: SeRestorePrivilege 32 WMIC.exe Token: SeShutdownPrivilege 32 WMIC.exe Token: SeDebugPrivilege 32 WMIC.exe Token: SeSystemEnvironmentPrivilege 32 WMIC.exe Token: SeRemoteShutdownPrivilege 32 WMIC.exe Token: SeUndockPrivilege 32 WMIC.exe Token: SeManageVolumePrivilege 32 WMIC.exe Token: 33 32 WMIC.exe Token: 34 32 WMIC.exe Token: 35 32 WMIC.exe Token: 36 32 WMIC.exe Token: SeIncreaseQuotaPrivilege 32 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 1984 5004 cmd.exe 86 PID 5004 wrote to memory of 1984 5004 cmd.exe 86 PID 1984 wrote to memory of 2136 1984 cmd.exe 87 PID 1984 wrote to memory of 2136 1984 cmd.exe 87 PID 1984 wrote to memory of 2384 1984 cmd.exe 88 PID 1984 wrote to memory of 2384 1984 cmd.exe 88 PID 5004 wrote to memory of 3656 5004 cmd.exe 90 PID 5004 wrote to memory of 3656 5004 cmd.exe 90 PID 5004 wrote to memory of 1412 5004 cmd.exe 91 PID 5004 wrote to memory of 1412 5004 cmd.exe 91 PID 5004 wrote to memory of 4148 5004 cmd.exe 92 PID 5004 wrote to memory of 4148 5004 cmd.exe 92 PID 5004 wrote to memory of 3968 5004 cmd.exe 93 PID 5004 wrote to memory of 3968 5004 cmd.exe 93 PID 5004 wrote to memory of 1444 5004 cmd.exe 94 PID 5004 wrote to memory of 1444 5004 cmd.exe 94 PID 1444 wrote to memory of 32 1444 cmd.exe 95 PID 1444 wrote to memory of 32 1444 cmd.exe 95 PID 1444 wrote to memory of 5036 1444 cmd.exe 96 PID 1444 wrote to memory of 5036 1444 cmd.exe 96 PID 5004 wrote to memory of 4760 5004 cmd.exe 97 PID 5004 wrote to memory of 4760 5004 cmd.exe 97 PID 5004 wrote to memory of 3416 5004 cmd.exe 98 PID 5004 wrote to memory of 3416 5004 cmd.exe 98 PID 5004 wrote to memory of 2768 5004 cmd.exe 99 PID 5004 wrote to memory of 2768 5004 cmd.exe 99 PID 5004 wrote to memory of 1384 5004 cmd.exe 100 PID 5004 wrote to memory of 1384 5004 cmd.exe 100 PID 5004 wrote to memory of 816 5004 cmd.exe 101 PID 5004 wrote to memory of 816 5004 cmd.exe 101 PID 816 wrote to memory of 1168 816 cmd.exe 102 PID 816 wrote to memory of 1168 816 cmd.exe 102 PID 5004 wrote to memory of 2404 5004 cmd.exe 103 PID 5004 wrote to memory of 2404 5004 cmd.exe 103 PID 5004 wrote to memory of 1984 5004 cmd.exe 86 PID 5004 wrote to memory of 1984 5004 cmd.exe 86 PID 1984 wrote to memory of 2136 1984 cmd.exe 87 PID 1984 wrote to memory of 2136 1984 cmd.exe 87 PID 1984 wrote to memory of 2384 1984 cmd.exe 88 PID 1984 wrote to memory of 2384 1984 cmd.exe 88 PID 5004 wrote to memory of 3656 5004 cmd.exe 90 PID 5004 wrote to memory of 3656 5004 cmd.exe 90 PID 5004 wrote to memory of 1412 5004 cmd.exe 91 PID 5004 wrote to memory of 1412 5004 cmd.exe 91 PID 5004 wrote to memory of 4148 5004 cmd.exe 92 PID 5004 wrote to memory of 4148 5004 cmd.exe 92 PID 5004 wrote to memory of 3968 5004 cmd.exe 93 PID 5004 wrote to memory of 3968 5004 cmd.exe 93 PID 5004 wrote to memory of 1444 5004 cmd.exe 94 PID 5004 wrote to memory of 1444 5004 cmd.exe 94 PID 1444 wrote to memory of 32 1444 cmd.exe 95 PID 1444 wrote to memory of 32 1444 cmd.exe 95 PID 1444 wrote to memory of 5036 1444 cmd.exe 96 PID 1444 wrote to memory of 5036 1444 cmd.exe 96 PID 5004 wrote to memory of 4760 5004 cmd.exe 97 PID 5004 wrote to memory of 4760 5004 cmd.exe 97 PID 5004 wrote to memory of 3416 5004 cmd.exe 98 PID 5004 wrote to memory of 3416 5004 cmd.exe 98 PID 5004 wrote to memory of 2768 5004 cmd.exe 99 PID 5004 wrote to memory of 2768 5004 cmd.exe 99 PID 5004 wrote to memory of 1384 5004 cmd.exe 100 PID 5004 wrote to memory of 1384 5004 cmd.exe 100 PID 5004 wrote to memory of 816 5004 cmd.exe 101 PID 5004 wrote to memory of 816 5004 cmd.exe 101
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6GZ4B0XxJPfg\Requirement\MAC CHANGER.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2384
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:3656
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:1412
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:4148
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 8609CD057E06 /f2⤵PID:3968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:32
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:5036
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:4760
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:3416
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:2768
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:1384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:1168
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2404
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:4892