Overview
overview
10Static
static
3vxnperm.zip
windows10-2004-x64
10vxnperm.zip
windows11-ltsc_2024-x64
1vxnperm/RU...OF.bat
windows10-2004-x64
7vxnperm/RU...OF.bat
windows11-ltsc_2024-x64
7vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...TE.exe
windows10-2004-x64
1vxnperm/de...TE.exe
windows11-ltsc_2024-x64
1vxnperm/de...OA.exe
windows10-2004-x64
7vxnperm/de...OA.exe
windows11-ltsc_2024-x64
7vxnperm/de...64.dll
windows10-2004-x64
1vxnperm/de...64.dll
windows11-ltsc_2024-x64
1vxnperm/de...64.exe
windows10-2004-x64
1vxnperm/de...64.exe
windows11-ltsc_2024-x64
1vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...82.bat
windows10-2004-x64
8vxnperm/de...82.bat
windows11-ltsc_2024-x64
8vxnperm/de...4e.cat
windows10-2004-x64
8vxnperm/de...4e.cat
windows11-ltsc_2024-x64
8vxnperm/de...4e.inf
windows10-2004-x64
1vxnperm/de...4e.inf
windows11-ltsc_2024-x64
1vxnperm/de...4e.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows10-2004-x64
3vxnperm/de...64.sys
windows11-ltsc_2024-x64
3vxnperm/de...64.sys
windows10-2004-x64
3Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
vxnperm.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
vxnperm.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
vxnperm/RUN AS ADMIN TO SPOOF.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
vxnperm/deps/AMIDEWINx64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
vxnperm/deps/AMIFLDRV64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
vxnperm/deps/EEUPDATE.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
vxnperm/deps/PSWOA.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
vxnperm/deps/PSWOA.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
vxnperm/deps/RTIoLib64.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
vxnperm/deps/RTNicPgW64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
vxnperm/deps/amigendrv64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
vxnperm/deps/i3782.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
vxnperm/deps/i3782.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
vxnperm/deps/iqvsw64e.cat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
vxnperm/deps/iqvsw64e.inf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
vxnperm/deps/iqvsw64e.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
vxnperm/deps/rtkio64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
vxnperm/deps/rtkio64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
vxnperm/deps/rtkiow10x64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target vxnperm/RUN AS ADMIN TO SPOOF.bat
- Size 318B
- Sample260804-nc4hssvsfv
- SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
- MD5 60972c42004f8c1fb66bfdc828d061cd
- SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
- SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
- TLSH T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe - Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3592 sc.exe 464 sc.exe 2784 sc.exe 6012 sc.exe 1588 sc.exe - Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1372 cmd.exe 4592 cmd.exe 2760 cmd.exe 5680 cmd.exe 4572 cmd.exe 4516 cmd.exe 5768 cmd.exe 4404 cmd.exe 1156 cmd.exe 5316 cmd.exe 4552 cmd.exe 4256 cmd.exe 5220 cmd.exe 5772 cmd.exe - Kills process with taskkill 4 IoCs
pid Process 5024 taskkill.exe 4684 taskkill.exe 5528 taskkill.exe 2528 taskkill.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5980 WMIC.exe 5980 WMIC.exe 5980 WMIC.exe 5980 WMIC.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 804 Process not Found 804 Process not Found 804 Process not Found 804 Process not Found 804 Process not Found 804 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5024 taskkill.exe Token: SeDebugPrivilege 4684 taskkill.exe Token: SeDebugPrivilege 5528 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 5784 svchost.exe Token: SeIncreaseQuotaPrivilege 5784 svchost.exe Token: SeSecurityPrivilege 5784 svchost.exe Token: SeTakeOwnershipPrivilege 5784 svchost.exe Token: SeLoadDriverPrivilege 5784 svchost.exe Token: SeSystemtimePrivilege 5784 svchost.exe Token: SeBackupPrivilege 5784 svchost.exe Token: SeRestorePrivilege 5784 svchost.exe Token: SeShutdownPrivilege 5784 svchost.exe Token: SeSystemEnvironmentPrivilege 5784 svchost.exe Token: SeUndockPrivilege 5784 svchost.exe Token: SeManageVolumePrivilege 5784 svchost.exe Token: SeAssignPrimaryTokenPrivilege 5784 svchost.exe Token: SeIncreaseQuotaPrivilege 5784 svchost.exe Token: SeSecurityPrivilege 5784 svchost.exe Token: SeTakeOwnershipPrivilege 5784 svchost.exe Token: SeLoadDriverPrivilege 5784 svchost.exe Token: SeSystemtimePrivilege 5784 svchost.exe Token: SeBackupPrivilege 5784 svchost.exe Token: SeRestorePrivilege 5784 svchost.exe Token: SeShutdownPrivilege 5784 svchost.exe Token: SeSystemEnvironmentPrivilege 5784 svchost.exe Token: SeUndockPrivilege 5784 svchost.exe Token: SeManageVolumePrivilege 5784 svchost.exe Token: SeAssignPrimaryTokenPrivilege 5784 svchost.exe Token: SeIncreaseQuotaPrivilege 5784 svchost.exe Token: SeSecurityPrivilege 5784 svchost.exe Token: SeTakeOwnershipPrivilege 5784 svchost.exe Token: SeLoadDriverPrivilege 5784 svchost.exe Token: SeSystemtimePrivilege 5784 svchost.exe Token: SeBackupPrivilege 5784 svchost.exe Token: SeRestorePrivilege 5784 svchost.exe Token: SeShutdownPrivilege 5784 svchost.exe Token: SeSystemEnvironmentPrivilege 5784 svchost.exe Token: SeUndockPrivilege 5784 svchost.exe Token: SeManageVolumePrivilege 5784 svchost.exe Token: SeAssignPrimaryTokenPrivilege 5784 svchost.exe Token: SeIncreaseQuotaPrivilege 5784 svchost.exe Token: SeSecurityPrivilege 5784 svchost.exe Token: SeTakeOwnershipPrivilege 5784 svchost.exe Token: SeLoadDriverPrivilege 5784 svchost.exe Token: SeSystemtimePrivilege 5784 svchost.exe Token: SeBackupPrivilege 5784 svchost.exe Token: SeRestorePrivilege 5784 svchost.exe Token: SeShutdownPrivilege 5784 svchost.exe Token: SeSystemEnvironmentPrivilege 5784 svchost.exe Token: SeUndockPrivilege 5784 svchost.exe Token: SeManageVolumePrivilege 5784 svchost.exe Token: SeAssignPrimaryTokenPrivilege 5784 svchost.exe Token: SeIncreaseQuotaPrivilege 5784 svchost.exe Token: SeSecurityPrivilege 5784 svchost.exe Token: SeTakeOwnershipPrivilege 5784 svchost.exe Token: SeLoadDriverPrivilege 5784 svchost.exe Token: SeSystemtimePrivilege 5784 svchost.exe Token: SeBackupPrivilege 5784 svchost.exe Token: SeRestorePrivilege 5784 svchost.exe Token: SeShutdownPrivilege 5784 svchost.exe Token: SeSystemEnvironmentPrivilege 5784 svchost.exe Token: SeUndockPrivilege 5784 svchost.exe Token: SeManageVolumePrivilege 5784 svchost.exe Token: SeAssignPrimaryTokenPrivilege 5784 svchost.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 5316 wrote to memory of 3240 5316 cmd.exe 90 PID 3240 wrote to memory of 4592 3240 PSWOA.exe 91 PID 4592 wrote to memory of 5024 4592 cmd.exe 92 PID 3240 wrote to memory of 4552 3240 PSWOA.exe 94 PID 4552 wrote to memory of 6012 4552 cmd.exe 95 PID 3240 wrote to memory of 4256 3240 PSWOA.exe 96 PID 4256 wrote to memory of 2736 4256 cmd.exe 97 PID 2736 wrote to memory of 1620 2736 net.exe 98 PID 3240 wrote to memory of 2760 3240 PSWOA.exe 99 PID 2760 wrote to memory of 4684 2760 cmd.exe 100 PID 3240 wrote to memory of 5680 3240 PSWOA.exe 101 PID 3240 wrote to memory of 4572 3240 PSWOA.exe 102 PID 4572 wrote to memory of 4132 4572 cmd.exe 103 PID 3240 wrote to memory of 4516 3240 PSWOA.exe 104 PID 4516 wrote to memory of 1588 4516 cmd.exe 105 PID 3240 wrote to memory of 5768 3240 PSWOA.exe 106 PID 5768 wrote to memory of 3592 5768 cmd.exe 107 PID 3240 wrote to memory of 5220 3240 PSWOA.exe 109 PID 5220 wrote to memory of 464 5220 cmd.exe 110 PID 3240 wrote to memory of 4404 3240 PSWOA.exe 111 PID 4404 wrote to memory of 5528 4404 cmd.exe 112 PID 3240 wrote to memory of 1156 3240 PSWOA.exe 115 PID 1156 wrote to memory of 2784 1156 cmd.exe 116 PID 3240 wrote to memory of 5772 3240 PSWOA.exe 117 PID 5772 wrote to memory of 2528 5772 cmd.exe 118 PID 3240 wrote to memory of 1372 3240 PSWOA.exe 120 PID 1372 wrote to memory of 5980 1372 cmd.exe 121 PID 3240 wrote to memory of 4612 3240 PSWOA.exe 123 PID 3240 wrote to memory of 2104 3240 PSWOA.exe 125 PID 3240 wrote to memory of 3776 3240 PSWOA.exe 127 PID 3240 wrote to memory of 2140 3240 PSWOA.exe 129 PID 3240 wrote to memory of 424 3240 PSWOA.exe 131 PID 3240 wrote to memory of 4216 3240 PSWOA.exe 134
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vxnperm\RUN AS ADMIN TO SPOOF.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\PSWOA.exePSWOA.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\sc.exesc config winmgmt start=disabled4⤵
- Launches sc.exe
PID:6012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\system32\net.exenet stop winmgmt /y4⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y5⤵PID:1620
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem3⤵
- Executes a command shell one-liner
PID:5680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\System32\Wbem\WmiPrvSE.exewmiprvse /regserver4⤵
- Modifies registry class
PID:4132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\system32\sc.exesc config winmgmt start= auto4⤵
- Launches sc.exe
PID:1588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:3592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\system32\sc.exesc stop winmgmt4⤵
- Launches sc.exe
PID:464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:2784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
PID:2528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get cat4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5980
-
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BM3⤵PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /SS3⤵PID:2104
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /BS3⤵PID:3776
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /CS3⤵PID:2140
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PSN3⤵PID:424
-
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amidewinx64.exeamidewinx64.exe /PPN3⤵PID:4216
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:4992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5784
-
C:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sysC:\Users\Admin\AppData\Local\Temp\vxnperm\deps\amigendrv64.sys1⤵PID:3204