3828f4a8cbddd5ca68751e7342ca769f1e6488d9a8350491d850a18427dc4c39

Resubmissions

19/07/2026, 19:39

260719-ydbvaads918

19/07/2026, 19:38

260719-yct98sat4r8

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PermSpoofer.exe
Size 670KB
Sample260719-ydbvaads91
SHA256 3828f4a8cbddd5ca68751e7342ca769f1e6488d9a8350491d850a18427dc4c39
MD5 84327300495b887e46d020b7a93a8daf
SHA1 42fb830109493fb948b9c3f3d0ba76d435cec460
SHA512 3ec0b4721caf7c0891b5b6adfc5c1e58c60cbefce0c5e96ee4ceb31d8ac7f940db7c6d58c037cebf644b41d60c12df720637b242f5b6e1d232e8804c7cb5dfbd
SSDEEP 12288:+P5NWyMZdUhjVMILIUJqaJwdEqG7dr9VWqmrDc0K6:wNRMfGuILIWquwdU+NDc
TLSH
T135E48E6AABA505E9C1B7C17D85178613F776B0491320CBDB53E085B92F13AE82F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4336	cmd.exe
616	cmd.exe
996	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1280	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 4336	932	PermSpoofer.exe	90
PID 4336 wrote to memory of 4196	4336	cmd.exe	91
PID 4336 wrote to memory of 5620	4336	cmd.exe	92
PID 4336 wrote to memory of 5908	4336	cmd.exe	93
PID 932 wrote to memory of 616	932	PermSpoofer.exe	95
PID 616 wrote to memory of 996	616	cmd.exe	96
PID 996 wrote to memory of 1280	996	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\PermSpoofer.exe" MD5
    3⤵
    PID:4196
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5620
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads