08a7b6d933538350b7634e495a43a3bbc758e824cc4dbf75a2bce1d32c82d252

Analysis

max time kernel
146s
max time network
37s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Perm.exe
Size

164KB
MD5

08cc4c87314d8c879928c346ecb0e598
SHA1

75b97801226c54fdd1d47b9590d64e0f48b9e35c
SHA256

08a7b6d933538350b7634e495a43a3bbc758e824cc4dbf75a2bce1d32c82d252
SHA512

acd5202dd036b2f78945efd200b3feb428e382db2fbc7a17ef66fdc77811813b91a7cd4145922a1156a730740510e05b03d5c975f76c04135cdef780084750e5
SSDEEP

3072:Cb56/a6rnl+OZYET34CNUfETJRg3IbgNeNYcGzl:CbAej5fEDgYbgzcGz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Perm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Perm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Perm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Perm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
1016	TASKKILL.exe
2620	TASKKILL.exe
1444	TASKKILL.exe
1516	TASKKILL.exe
1612	TASKKILL.exe
2120	TASKKILL.exe
2296	TASKKILL.exe
2892	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2600	schtasks.exe
2588	schtasks.exe
2172	schtasks.exe
1868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1488	Perm.exe
1488	Perm.exe
1488	Perm.exe
1488	Perm.exe
1488	Perm.exe
3028	Perm.exe
3028	Perm.exe
3028	Perm.exe
3028	Perm.exe
3028	Perm.exe
844	Perm.exe
844	Perm.exe
844	Perm.exe
844	Perm.exe
844	Perm.exe
2208	Perm.exe
2208	Perm.exe
2208	Perm.exe
2208	Perm.exe
2208	Perm.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	Perm.exe
Token: SeDebugPrivilege	2892	TASKKILL.exe
Token: SeDebugPrivilege	1016	TASKKILL.exe
Token: SeDebugPrivilege	3028	Perm.exe
Token: SeDebugPrivilege	2620	TASKKILL.exe
Token: SeDebugPrivilege	1444	TASKKILL.exe
Token: SeDebugPrivilege	844	Perm.exe
Token: SeDebugPrivilege	1516	TASKKILL.exe
Token: SeDebugPrivilege	1612	TASKKILL.exe
Token: SeDebugPrivilege	2208	Perm.exe
Token: SeDebugPrivilege	2296	TASKKILL.exe
Token: SeDebugPrivilege	2120	TASKKILL.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2892	1488	Perm.exe	29
PID 1488 wrote to memory of 2892	1488	Perm.exe	29
PID 1488 wrote to memory of 2892	1488	Perm.exe	29
PID 1488 wrote to memory of 2892	1488	Perm.exe	29
PID 1488 wrote to memory of 1016	1488	Perm.exe	30
PID 1488 wrote to memory of 1016	1488	Perm.exe	30
PID 1488 wrote to memory of 1016	1488	Perm.exe	30
PID 1488 wrote to memory of 1016	1488	Perm.exe	30
PID 1488 wrote to memory of 2856	1488	Perm.exe	34
PID 1488 wrote to memory of 2856	1488	Perm.exe	34
PID 1488 wrote to memory of 2856	1488	Perm.exe	34
PID 1488 wrote to memory of 2856	1488	Perm.exe	34
PID 1488 wrote to memory of 2600	1488	Perm.exe	36
PID 1488 wrote to memory of 2600	1488	Perm.exe	36
PID 1488 wrote to memory of 2600	1488	Perm.exe	36
PID 1488 wrote to memory of 2600	1488	Perm.exe	36
PID 2724 wrote to memory of 3028	2724	taskeng.exe	39
PID 2724 wrote to memory of 3028	2724	taskeng.exe	39
PID 2724 wrote to memory of 3028	2724	taskeng.exe	39
PID 2724 wrote to memory of 3028	2724	taskeng.exe	39
PID 1488 wrote to memory of 2224	1488	Perm.exe	40
PID 1488 wrote to memory of 2224	1488	Perm.exe	40
PID 1488 wrote to memory of 2224	1488	Perm.exe	40
PID 1488 wrote to memory of 2224	1488	Perm.exe	40
PID 3028 wrote to memory of 2620	3028	Perm.exe	41
PID 3028 wrote to memory of 2620	3028	Perm.exe	41
PID 3028 wrote to memory of 2620	3028	Perm.exe	41
PID 3028 wrote to memory of 2620	3028	Perm.exe	41
PID 3028 wrote to memory of 1444	3028	Perm.exe	43
PID 3028 wrote to memory of 1444	3028	Perm.exe	43
PID 3028 wrote to memory of 1444	3028	Perm.exe	43
PID 3028 wrote to memory of 1444	3028	Perm.exe	43
PID 3028 wrote to memory of 1608	3028	Perm.exe	45
PID 3028 wrote to memory of 1608	3028	Perm.exe	45
PID 3028 wrote to memory of 1608	3028	Perm.exe	45
PID 3028 wrote to memory of 1608	3028	Perm.exe	45
PID 3028 wrote to memory of 2588	3028	Perm.exe	47
PID 3028 wrote to memory of 2588	3028	Perm.exe	47
PID 3028 wrote to memory of 2588	3028	Perm.exe	47
PID 3028 wrote to memory of 2588	3028	Perm.exe	47
PID 3028 wrote to memory of 2664	3028	Perm.exe	49
PID 3028 wrote to memory of 2664	3028	Perm.exe	49
PID 3028 wrote to memory of 2664	3028	Perm.exe	49
PID 3028 wrote to memory of 2664	3028	Perm.exe	49
PID 2724 wrote to memory of 844	2724	taskeng.exe	50
PID 2724 wrote to memory of 844	2724	taskeng.exe	50
PID 2724 wrote to memory of 844	2724	taskeng.exe	50
PID 2724 wrote to memory of 844	2724	taskeng.exe	50
PID 844 wrote to memory of 1516	844	Perm.exe	51
PID 844 wrote to memory of 1516	844	Perm.exe	51
PID 844 wrote to memory of 1516	844	Perm.exe	51
PID 844 wrote to memory of 1516	844	Perm.exe	51
PID 844 wrote to memory of 1612	844	Perm.exe	52
PID 844 wrote to memory of 1612	844	Perm.exe	52
PID 844 wrote to memory of 1612	844	Perm.exe	52
PID 844 wrote to memory of 1612	844	Perm.exe	52
PID 844 wrote to memory of 2040	844	Perm.exe	55
PID 844 wrote to memory of 2040	844	Perm.exe	55
PID 844 wrote to memory of 2040	844	Perm.exe	55
PID 844 wrote to memory of 2040	844	Perm.exe	55
PID 844 wrote to memory of 2172	844	Perm.exe	57
PID 844 wrote to memory of 2172	844	Perm.exe	57
PID 844 wrote to memory of 2172	844	Perm.exe	57
PID 844 wrote to memory of 2172	844	Perm.exe	57

C:\Users\Admin\AppData\Local\Temp\Perm.exe
"C:\Users\Admin\AppData\Local\Temp\Perm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Perm.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2600
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1016
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2224

C:\Windows\system32\taskeng.exe
taskeng.exe {0E1B5A7D-CCD7-43F5-9874-913229722075} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\Perm.exe
  C:\Users\Admin\AppData\Local\Temp\Perm.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Perm.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2588
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 628
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- C:\Users\Admin\AppData\Local\Temp\Perm.exe
  C:\Users\Admin\AppData\Local\Temp\Perm.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Perm.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 624
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2164
- C:\Users\Admin\AppData\Local\Temp\Perm.exe
  C:\Users\Admin\AppData\Local\Temp\Perm.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Perm.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1868
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 624
    3⤵
    - System Location Discovery: System Language Discovery
    PID:488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-0-0x0000000073D81000-0x0000000073D82000-memory.dmp

Filesize
4KB

Download
memory/1488-2-0x0000000073D80000-0x000000007432B000-memory.dmp

Filesize
5.7MB

Download
memory/1488-1-0x0000000073D80000-0x000000007432B000-memory.dmp

Filesize
5.7MB

Download
memory/1488-12-0x0000000073D80000-0x000000007432B000-memory.dmp

Filesize
5.7MB

Download
memory/1488-13-0x0000000073D80000-0x000000007432B000-memory.dmp

Filesize
5.7MB

Download