Overview
overview
10Static
static
3vxnperm.zip
windows10-2004-x64
10vxnperm.zip
windows11-ltsc_2024-x64
1vxnperm/RU...OF.bat
windows10-2004-x64
7vxnperm/RU...OF.bat
windows11-ltsc_2024-x64
7vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...TE.exe
windows10-2004-x64
1vxnperm/de...TE.exe
windows11-ltsc_2024-x64
1vxnperm/de...OA.exe
windows10-2004-x64
7vxnperm/de...OA.exe
windows11-ltsc_2024-x64
7vxnperm/de...64.dll
windows10-2004-x64
1vxnperm/de...64.dll
windows11-ltsc_2024-x64
1vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...82.bat
windows10-2004-x64
8vxnperm/de...82.bat
windows11-ltsc_2024-x64
8vxnperm/de...4e.cat
windows10-2004-x64
8vxnperm/de...4e.cat
windows11-ltsc_2024-x64
8vxnperm/de...4e.inf
windows10-2004-x64
1vxnperm/de...4e.inf
windows11-ltsc_2024-x64
1vxnperm/de...4e.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...64.sys
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
vxnperm.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
vxnperm.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
vxnperm/deps/PSWOA.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
vxnperm/deps/PSWOA.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
vxnperm/deps/amigendrv64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
vxnperm/deps/i3782.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
vxnperm/deps/i3782.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
vxnperm/deps/iqvsw64e.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
vxnperm/deps/rtkio64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
vxnperm/deps/rtkio64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
vxnperm/deps/rtkiow10x64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target vxnperm/RUN AS ADMIN TO SPOOF.bat
- Size 318B
- Sample260804-nc4hssvsfv
- SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
- MD5 60972c42004f8c1fb66bfdc828d061cd
- SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
- SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
- TLSH T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe - Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2436 sc.exe 368 sc.exe 3328 sc.exe 3112 sc.exe 4132 sc.exe - Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2732 cmd.exe 4156 cmd.exe 4160 cmd.exe 3256 cmd.exe 876 cmd.exe 628 cmd.exe 4088 cmd.exe 3296 cmd.exe 2504 cmd.exe 2424 cmd.exe 2156 cmd.exe 4148 cmd.exe 4044 cmd.exe 4872 cmd.exe - Kills process with taskkill 4 IoCs
pid Process 2236 taskkill.exe 2992 taskkill.exe 2100 taskkill.exe 2312 taskkill.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe - Runs net.exe
- Suspicious behavior: LoadsDriver 6 IoCs
pid Process 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2236 taskkill.exe Token: SeDebugPrivilege 2992 taskkill.exe Token: SeDebugPrivilege 2100 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2156 wrote to memory of 5032 2156 cmd.exe 84 PID 5032 wrote to memory of 4160 5032 PSWOA.exe 85 PID 4160 wrote to memory of 2236 4160 cmd.exe 86 PID 5032 wrote to memory of 3256 5032 PSWOA.exe 88 PID 3256 wrote to memory of 368 3256 cmd.exe 89 PID 5032 wrote to memory of 876 5032 PSWOA.exe 90 PID 876 wrote to memory of 4480 876 cmd.exe 91 PID 4480 wrote to memory of 2480 4480 net.exe 92 PID 5032 wrote to memory of 4148 5032 PSWOA.exe 93 PID 4148 wrote to memory of 2992 4148 cmd.exe 94 PID 5032 wrote to memory of 4044 5032 PSWOA.exe 95 PID 5032 wrote to memory of 628 5032 PSWOA.exe 96 PID 628 wrote to memory of 3376 628 cmd.exe 97 PID 5032 wrote to memory of 4088 5032 PSWOA.exe 98 PID 4088 wrote to memory of 3328 4088 cmd.exe 99 PID 5032 wrote to memory of 3296 5032 PSWOA.exe 100 PID 3296 wrote to memory of 3112 3296 cmd.exe 101 PID 5032 wrote to memory of 4872 5032 PSWOA.exe 103 PID 4872 wrote to memory of 4132 4872 cmd.exe 104 PID 5032 wrote to memory of 2504 5032 PSWOA.exe 105 PID 2504 wrote to memory of 2100 2504 cmd.exe 106 PID 5032 wrote to memory of 2424 5032 PSWOA.exe 109 PID 2424 wrote to memory of 2436 2424 cmd.exe 110 PID 5032 wrote to memory of 2732 5032 PSWOA.exe 111 PID 2732 wrote to memory of 2312 2732 cmd.exe 112 PID 5032 wrote to memory of 4156 5032 PSWOA.exe 114 PID 4156 wrote to memory of 716 4156 cmd.exe 115 PID 5032 wrote to memory of 1664 5032 PSWOA.exe 117 PID 5032 wrote to memory of 2304 5032 PSWOA.exe 119 PID 5032 wrote to memory of 4560 5032 PSWOA.exe 121 PID 5032 wrote to memory of 3224 5032 PSWOA.exe 123 PID 5032 wrote to memory of 5068 5032 PSWOA.exe 125 PID 5032 wrote to memory of 2872 5032 PSWOA.exe 127
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vxnperm\RUN AS ADMIN TO SPOOF.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\PSWOA.exePSWOA.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\sc.exesc config winmgmt start=disabled4⤵
- Launches sc.exe
PID:368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\system32\net.exenet stop winmgmt /y4⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y5⤵PID:2480
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem3⤵
- Executes a command shell one-liner
PID:4044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\System32\Wbem\WmiPrvSE.exewmiprvse /regserver4⤵
- Modifies registry class
PID:3376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\system32\sc.exesc config winmgmt start= auto4⤵
- Launches sc.exe
PID:3328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:3112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\system32\sc.exesc stop winmgmt4⤵
- Launches sc.exe
PID:4132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:2436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
PID:2312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get cat4⤵PID:716
-
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BM3⤵PID:1664
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /SS3⤵PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BS3⤵PID:4560
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /CS3⤵PID:3224
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PSN3⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PPN3⤵PID:2872
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:4524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sysC:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sys1⤵PID:3260