Overview
overview
10Static
static
3vxnperm.zip
windows10-2004-x64
10vxnperm.zip
windows11-ltsc_2024-x64
1vxnperm/RU...OF.bat
windows10-2004-x64
7vxnperm/RU...OF.bat
windows11-ltsc_2024-x64
7vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...TE.exe
windows10-2004-x64
1vxnperm/de...TE.exe
windows11-ltsc_2024-x64
1vxnperm/de...OA.exe
windows10-2004-x64
7vxnperm/de...OA.exe
windows11-ltsc_2024-x64
7vxnperm/de...64.dll
windows10-2004-x64
1vxnperm/de...64.dll
windows11-ltsc_2024-x64
1vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...82.bat
windows10-2004-x64
8vxnperm/de...82.bat
windows11-ltsc_2024-x64
8vxnperm/de...4e.cat
windows10-2004-x64
8vxnperm/de...4e.cat
windows11-ltsc_2024-x64
8vxnperm/de...4e.inf
windows10-2004-x64
1vxnperm/de...4e.inf
windows11-ltsc_2024-x64
1vxnperm/de...4e.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...64.sys
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
vxnperm.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
vxnperm.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
vxnperm/deps/PSWOA.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
vxnperm/deps/PSWOA.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
vxnperm/deps/amigendrv64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
vxnperm/deps/i3782.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
vxnperm/deps/i3782.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
vxnperm/deps/iqvsw64e.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
vxnperm/deps/rtkio64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
vxnperm/deps/rtkio64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
vxnperm/deps/rtkiow10x64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target vxnperm/deps/PSWOA.exe
- Size 397KB
- Sample260804-nc4hssvsfv
- SHA256 8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462
- MD5 d30a3ee3eafd3f37015366868c09e725
- SHA1 505c1b4e2f4fbcf3707f0bd50148e722377c5e40
- SHA512 4d76cfea7601a8c799ee7e9837b6798c7fd4b0967c268c85226ac94ae7a84777fdb69bd88f5d5a51fdc77b9d225b62c4017e0f7b0e095681fe426809580e4afa
- SSDEEP 6144:IR1r7t5NyBRatI32wlSlvtBqmG9AQ5/v/I:ITtTSaM7lUtcAKw
- TLSH T129848C09F99145F8D9A7957889220646EB31BC4A43B0DBDF23F849951F17BF06E3AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe - Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3848 sc.exe 4740 sc.exe 1312 sc.exe 1064 sc.exe 4188 sc.exe - Executes a command shell one-liner 1 TTPs 13 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1896 cmd.exe 2544 cmd.exe 4016 cmd.exe 1204 cmd.exe 1968 cmd.exe 4284 cmd.exe 3048 cmd.exe 4764 cmd.exe 3968 cmd.exe 2376 cmd.exe 3632 cmd.exe 3028 cmd.exe 1736 cmd.exe - Kills process with taskkill 4 IoCs
pid Process 2908 taskkill.exe 4948 taskkill.exe 1716 taskkill.exe 2264 taskkill.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe - Runs net.exe
- Suspicious behavior: LoadsDriver 5 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2908 taskkill.exe Token: SeDebugPrivilege 4948 taskkill.exe Token: SeDebugPrivilege 1716 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 4600 svchost.exe Token: SeIncreaseQuotaPrivilege 4600 svchost.exe Token: SeSecurityPrivilege 4600 svchost.exe Token: SeTakeOwnershipPrivilege 4600 svchost.exe Token: SeLoadDriverPrivilege 4600 svchost.exe Token: SeSystemtimePrivilege 4600 svchost.exe Token: SeBackupPrivilege 4600 svchost.exe Token: SeRestorePrivilege 4600 svchost.exe Token: SeShutdownPrivilege 4600 svchost.exe Token: SeSystemEnvironmentPrivilege 4600 svchost.exe Token: SeUndockPrivilege 4600 svchost.exe Token: SeManageVolumePrivilege 4600 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4600 svchost.exe Token: SeIncreaseQuotaPrivilege 4600 svchost.exe Token: SeSecurityPrivilege 4600 svchost.exe Token: SeTakeOwnershipPrivilege 4600 svchost.exe Token: SeLoadDriverPrivilege 4600 svchost.exe Token: SeSystemtimePrivilege 4600 svchost.exe Token: SeBackupPrivilege 4600 svchost.exe Token: SeRestorePrivilege 4600 svchost.exe Token: SeShutdownPrivilege 4600 svchost.exe Token: SeSystemEnvironmentPrivilege 4600 svchost.exe Token: SeUndockPrivilege 4600 svchost.exe Token: SeManageVolumePrivilege 4600 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4600 svchost.exe Token: SeIncreaseQuotaPrivilege 4600 svchost.exe Token: SeSecurityPrivilege 4600 svchost.exe Token: SeTakeOwnershipPrivilege 4600 svchost.exe Token: SeLoadDriverPrivilege 4600 svchost.exe Token: SeSystemtimePrivilege 4600 svchost.exe Token: SeBackupPrivilege 4600 svchost.exe Token: SeRestorePrivilege 4600 svchost.exe Token: SeShutdownPrivilege 4600 svchost.exe Token: SeSystemEnvironmentPrivilege 4600 svchost.exe Token: SeUndockPrivilege 4600 svchost.exe Token: SeManageVolumePrivilege 4600 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4600 svchost.exe Token: SeIncreaseQuotaPrivilege 4600 svchost.exe Token: SeSecurityPrivilege 4600 svchost.exe Token: SeTakeOwnershipPrivilege 4600 svchost.exe Token: SeLoadDriverPrivilege 4600 svchost.exe Token: SeSystemtimePrivilege 4600 svchost.exe Token: SeBackupPrivilege 4600 svchost.exe Token: SeRestorePrivilege 4600 svchost.exe Token: SeShutdownPrivilege 4600 svchost.exe Token: SeSystemEnvironmentPrivilege 4600 svchost.exe Token: SeUndockPrivilege 4600 svchost.exe Token: SeManageVolumePrivilege 4600 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4600 svchost.exe Token: SeIncreaseQuotaPrivilege 4600 svchost.exe Token: SeSecurityPrivilege 4600 svchost.exe Token: SeTakeOwnershipPrivilege 4600 svchost.exe Token: SeLoadDriverPrivilege 4600 svchost.exe Token: SeSystemtimePrivilege 4600 svchost.exe Token: SeBackupPrivilege 4600 svchost.exe Token: SeRestorePrivilege 4600 svchost.exe Token: SeShutdownPrivilege 4600 svchost.exe Token: SeSystemEnvironmentPrivilege 4600 svchost.exe Token: SeUndockPrivilege 4600 svchost.exe Token: SeManageVolumePrivilege 4600 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4600 svchost.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2580 wrote to memory of 1204 2580 PSWOA.exe 86 PID 1204 wrote to memory of 2908 1204 cmd.exe 87 PID 2580 wrote to memory of 1968 2580 PSWOA.exe 89 PID 1968 wrote to memory of 3848 1968 cmd.exe 90 PID 2580 wrote to memory of 3028 2580 PSWOA.exe 91 PID 3028 wrote to memory of 2632 3028 cmd.exe 92 PID 2632 wrote to memory of 4876 2632 net.exe 93 PID 2580 wrote to memory of 4284 2580 PSWOA.exe 94 PID 4284 wrote to memory of 4948 4284 cmd.exe 95 PID 2580 wrote to memory of 1736 2580 PSWOA.exe 96 PID 2580 wrote to memory of 3048 2580 PSWOA.exe 97 PID 3048 wrote to memory of 4636 3048 cmd.exe 98 PID 2580 wrote to memory of 1896 2580 PSWOA.exe 99 PID 1896 wrote to memory of 4740 1896 cmd.exe 100 PID 2580 wrote to memory of 4764 2580 PSWOA.exe 101 PID 4764 wrote to memory of 1312 4764 cmd.exe 102 PID 2580 wrote to memory of 2544 2580 PSWOA.exe 104 PID 2544 wrote to memory of 1064 2544 cmd.exe 105 PID 2580 wrote to memory of 3968 2580 PSWOA.exe 106 PID 3968 wrote to memory of 1716 3968 cmd.exe 107 PID 2580 wrote to memory of 2376 2580 PSWOA.exe 110 PID 2376 wrote to memory of 4188 2376 cmd.exe 111 PID 2580 wrote to memory of 3632 2580 PSWOA.exe 112 PID 3632 wrote to memory of 2264 3632 cmd.exe 113 PID 2580 wrote to memory of 4016 2580 PSWOA.exe 115 PID 4016 wrote to memory of 5052 4016 cmd.exe 116 PID 2580 wrote to memory of 4000 2580 PSWOA.exe 118 PID 2580 wrote to memory of 4656 2580 PSWOA.exe 120 PID 2580 wrote to memory of 4408 2580 PSWOA.exe 122 PID 2580 wrote to memory of 2604 2580 PSWOA.exe 124 PID 2580 wrote to memory of 2312 2580 PSWOA.exe 126 PID 2580 wrote to memory of 3436 2580 PSWOA.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\PSWOA.exe"C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\PSWOA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\sc.exesc config winmgmt start=disabled3⤵
- Launches sc.exe
PID:3848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\system32\net.exenet stop winmgmt /y3⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y4⤵PID:4876
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem2⤵
- Executes a command shell one-liner
PID:1736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\System32\Wbem\WmiPrvSE.exewmiprvse /regserver3⤵
- Modifies registry class
PID:4636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\sc.exesc config winmgmt start= auto3⤵
- Launches sc.exe
PID:4740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\system32\sc.exesc start winmgmt3⤵
- Launches sc.exe
PID:1312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\sc.exesc stop winmgmt3⤵
- Launches sc.exe
PID:1064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\sc.exesc start winmgmt3⤵
- Launches sc.exe
PID:4188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
PID:2264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get cat3⤵PID:5052
-
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BM2⤵PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /SS2⤵PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BS2⤵PID:4408
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /CS2⤵PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PSN2⤵PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PPN2⤵PID:3436
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:3828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sysC:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sys1⤵PID:4680