Overview
overview
10Static
static
3vxnperm.zip
windows10-2004-x64
10vxnperm.zip
windows11-ltsc_2024-x64
1vxnperm/RU...OF.bat
windows10-2004-x64
7vxnperm/RU...OF.bat
windows11-ltsc_2024-x64
7vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...TE.exe
windows10-2004-x64
1vxnperm/de...TE.exe
windows11-ltsc_2024-x64
1vxnperm/de...OA.exe
windows10-2004-x64
7vxnperm/de...OA.exe
windows11-ltsc_2024-x64
7vxnperm/de...64.dll
windows10-2004-x64
1vxnperm/de...64.dll
windows11-ltsc_2024-x64
1vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...82.bat
windows10-2004-x64
8vxnperm/de...82.bat
windows11-ltsc_2024-x64
8vxnperm/de...4e.cat
windows10-2004-x64
8vxnperm/de...4e.cat
windows11-ltsc_2024-x64
8vxnperm/de...4e.inf
windows10-2004-x64
1vxnperm/de...4e.inf
windows11-ltsc_2024-x64
1vxnperm/de...4e.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...64.sys
windows10-2004-x64
3Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
vxnperm.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
vxnperm.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
vxnperm/deps/PSWOA.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
vxnperm/deps/PSWOA.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
vxnperm/deps/amigendrv64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
vxnperm/deps/i3782.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
vxnperm/deps/i3782.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
vxnperm/deps/iqvsw64e.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
vxnperm/deps/rtkio64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
vxnperm/deps/rtkio64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
vxnperm/deps/rtkiow10x64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target vxnperm/deps/PSWOA.exe
- Size 397KB
- Sample260804-nc4hssvsfv
- SHA256 8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462
- MD5 d30a3ee3eafd3f37015366868c09e725
- SHA1 505c1b4e2f4fbcf3707f0bd50148e722377c5e40
- SHA512 4d76cfea7601a8c799ee7e9837b6798c7fd4b0967c268c85226ac94ae7a84777fdb69bd88f5d5a51fdc77b9d225b62c4017e0f7b0e095681fe426809580e4afa
- SSDEEP 6144:IR1r7t5NyBRatI32wlSlvtBqmG9AQ5/v/I:ITtTSaM7lUtcAKw
- TLSH T129848C09F99145F8D9A7957889220646EB31BC4A43B0DBDF23F849951F17BF06E3AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe - Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3212 sc.exe 3724 sc.exe 2368 sc.exe 352 sc.exe 2888 sc.exe - Executes a command shell one-liner 1 TTPs 13 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1140 cmd.exe 1520 cmd.exe 5996 cmd.exe 1248 cmd.exe 4912 cmd.exe 4700 cmd.exe 4820 cmd.exe 4676 cmd.exe 6060 cmd.exe 4860 cmd.exe 3428 cmd.exe 2864 cmd.exe 1952 cmd.exe - Kills process with taskkill 4 IoCs
pid Process 4976 taskkill.exe 5664 taskkill.exe 236 taskkill.exe 1152 taskkill.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2732 WMIC.exe 2732 WMIC.exe 2732 WMIC.exe 2732 WMIC.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4976 taskkill.exe Token: SeDebugPrivilege 5664 taskkill.exe Token: SeDebugPrivilege 236 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 2284 svchost.exe Token: SeIncreaseQuotaPrivilege 2284 svchost.exe Token: SeSecurityPrivilege 2284 svchost.exe Token: SeTakeOwnershipPrivilege 2284 svchost.exe Token: SeLoadDriverPrivilege 2284 svchost.exe Token: SeSystemtimePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeShutdownPrivilege 2284 svchost.exe Token: SeSystemEnvironmentPrivilege 2284 svchost.exe Token: SeUndockPrivilege 2284 svchost.exe Token: SeManageVolumePrivilege 2284 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2284 svchost.exe Token: SeIncreaseQuotaPrivilege 2284 svchost.exe Token: SeSecurityPrivilege 2284 svchost.exe Token: SeTakeOwnershipPrivilege 2284 svchost.exe Token: SeLoadDriverPrivilege 2284 svchost.exe Token: SeSystemtimePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeShutdownPrivilege 2284 svchost.exe Token: SeSystemEnvironmentPrivilege 2284 svchost.exe Token: SeUndockPrivilege 2284 svchost.exe Token: SeManageVolumePrivilege 2284 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2284 svchost.exe Token: SeIncreaseQuotaPrivilege 2284 svchost.exe Token: SeSecurityPrivilege 2284 svchost.exe Token: SeTakeOwnershipPrivilege 2284 svchost.exe Token: SeLoadDriverPrivilege 2284 svchost.exe Token: SeSystemtimePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeShutdownPrivilege 2284 svchost.exe Token: SeSystemEnvironmentPrivilege 2284 svchost.exe Token: SeUndockPrivilege 2284 svchost.exe Token: SeManageVolumePrivilege 2284 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2284 svchost.exe Token: SeIncreaseQuotaPrivilege 2284 svchost.exe Token: SeSecurityPrivilege 2284 svchost.exe Token: SeTakeOwnershipPrivilege 2284 svchost.exe Token: SeLoadDriverPrivilege 2284 svchost.exe Token: SeSystemtimePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeShutdownPrivilege 2284 svchost.exe Token: SeSystemEnvironmentPrivilege 2284 svchost.exe Token: SeUndockPrivilege 2284 svchost.exe Token: SeManageVolumePrivilege 2284 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2284 svchost.exe Token: SeIncreaseQuotaPrivilege 2284 svchost.exe Token: SeSecurityPrivilege 2284 svchost.exe Token: SeTakeOwnershipPrivilege 2284 svchost.exe Token: SeLoadDriverPrivilege 2284 svchost.exe Token: SeSystemtimePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeShutdownPrivilege 2284 svchost.exe Token: SeSystemEnvironmentPrivilege 2284 svchost.exe Token: SeUndockPrivilege 2284 svchost.exe Token: SeManageVolumePrivilege 2284 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2284 svchost.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2168 wrote to memory of 1952 2168 PSWOA.exe 90 PID 1952 wrote to memory of 4976 1952 cmd.exe 91 PID 2168 wrote to memory of 4912 2168 PSWOA.exe 93 PID 4912 wrote to memory of 3212 4912 cmd.exe 94 PID 2168 wrote to memory of 1140 2168 PSWOA.exe 95 PID 1140 wrote to memory of 1460 1140 cmd.exe 96 PID 1460 wrote to memory of 4908 1460 net.exe 97 PID 2168 wrote to memory of 4700 2168 PSWOA.exe 98 PID 4700 wrote to memory of 5664 4700 cmd.exe 99 PID 2168 wrote to memory of 4820 2168 PSWOA.exe 100 PID 2168 wrote to memory of 4676 2168 PSWOA.exe 101 PID 4676 wrote to memory of 3540 4676 cmd.exe 102 PID 2168 wrote to memory of 1520 2168 PSWOA.exe 103 PID 1520 wrote to memory of 3724 1520 cmd.exe 104 PID 2168 wrote to memory of 6060 2168 PSWOA.exe 105 PID 6060 wrote to memory of 2368 6060 cmd.exe 106 PID 2168 wrote to memory of 4860 2168 PSWOA.exe 108 PID 4860 wrote to memory of 352 4860 cmd.exe 109 PID 2168 wrote to memory of 5996 2168 PSWOA.exe 110 PID 5996 wrote to memory of 236 5996 cmd.exe 111 PID 2168 wrote to memory of 3428 2168 PSWOA.exe 114 PID 3428 wrote to memory of 2888 3428 cmd.exe 115 PID 2168 wrote to memory of 2864 2168 PSWOA.exe 116 PID 2864 wrote to memory of 1152 2864 cmd.exe 117 PID 2168 wrote to memory of 1248 2168 PSWOA.exe 119 PID 1248 wrote to memory of 2732 1248 cmd.exe 120 PID 2168 wrote to memory of 4160 2168 PSWOA.exe 122 PID 2168 wrote to memory of 1752 2168 PSWOA.exe 124 PID 2168 wrote to memory of 5652 2168 PSWOA.exe 126 PID 2168 wrote to memory of 1832 2168 PSWOA.exe 128 PID 2168 wrote to memory of 1324 2168 PSWOA.exe 130 PID 2168 wrote to memory of 4400 2168 PSWOA.exe 132
Processes
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\PSWOA.exe"C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\PSWOA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\sc.exesc config winmgmt start=disabled3⤵
- Launches sc.exe
PID:3212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\system32\net.exenet stop winmgmt /y3⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y4⤵PID:4908
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem2⤵
- Executes a command shell one-liner
PID:4820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\System32\Wbem\WmiPrvSE.exewmiprvse /regserver3⤵
- Modifies registry class
PID:3540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\sc.exesc config winmgmt start= auto3⤵
- Launches sc.exe
PID:3724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\system32\sc.exesc start winmgmt3⤵
- Launches sc.exe
PID:2368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\sc.exesc stop winmgmt3⤵
- Launches sc.exe
PID:352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\system32\sc.exesc start winmgmt3⤵
- Launches sc.exe
PID:2888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t3⤵
- Kills process with taskkill
PID:1152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get cat3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BM2⤵PID:4160
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /SS2⤵PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BS2⤵PID:5652
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /CS2⤵PID:1832
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PSN2⤵PID:1324
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PPN2⤵PID:4400
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sysC:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sys1⤵PID:4608