3828f4a8cbddd5ca68751e7342ca769f1e6488d9a8350491d850a18427dc4c39

Resubmissions

19/07/2026, 19:39

260719-ydbvaads918

19/07/2026, 19:38

260719-yct98sat4r8

Analysis

user interaction
yes
max time kernel
110s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PermSpoofer.exe
Size 670KB
Sample260719-ydbvaads91
SHA256 3828f4a8cbddd5ca68751e7342ca769f1e6488d9a8350491d850a18427dc4c39
MD5 84327300495b887e46d020b7a93a8daf
SHA1 42fb830109493fb948b9c3f3d0ba76d435cec460
SHA512 3ec0b4721caf7c0891b5b6adfc5c1e58c60cbefce0c5e96ee4ceb31d8ac7f940db7c6d58c037cebf644b41d60c12df720637b242f5b6e1d232e8804c7cb5dfbd
SSDEEP 12288:+P5NWyMZdUhjVMILIUJqaJwdEqG7dr9VWqmrDc0K6:wNRMfGuILIWquwdU+NDc
TLSH
T135E48E6AABA505E9C1B7C17D85178613F776B0491320CBDB53E085B92F13AE82F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3020	cmd.exe
1640	cmd.exe
2720	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2708	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3020	2388	PermSpoofer.exe	91
PID 3020 wrote to memory of 2808	3020	cmd.exe	92
PID 3020 wrote to memory of 5020	3020	cmd.exe	93
PID 3020 wrote to memory of 1492	3020	cmd.exe	94
PID 2388 wrote to memory of 1640	2388	PermSpoofer.exe	103
PID 1640 wrote to memory of 2720	1640	cmd.exe	104
PID 2720 wrote to memory of 2708	2720	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe" MD5
    3⤵
    PID:2808
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5020
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Timeout was reached && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Timeout was reached && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads