83b92697e01a7e9bdd32c6b0b9a0926b669ff1c0c12ceb186a8c9a56b0c08236

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MärzwarePerm.exe
Size 11.9MB
Sample260912-qn2jpace53
SHA256 83b92697e01a7e9bdd32c6b0b9a0926b669ff1c0c12ceb186a8c9a56b0c08236
MD5 23af3de8b4fcc9080920163e5ded674c
SHA1 581d41595a02787850eb47c5571ac74eb9581e00
SHA512 326c8c399bfc0e38528c7f522717dd884eaf26a2bc8db08eff459f097521ad43173c9f0fd291bc1cc302b5b2637dac3196d4d7dcd5acc2186d7b8e70fb2e517b
SSDEEP 196608:VT4qzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:lu+I3qspVAmsu2K
TLSH
T1B3C68D16A7AA49E1D0B3923489669667F3B2BC100FB4C7DF7298560E1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	MärzwarePerm.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	MärzwarePerm.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1548	cmd.exe
1216	cmd.exe
3188	cmd.exe
3732	cmd.exe
204	cmd.exe
4744	cmd.exe
3960	cmd.exe
4632	cmd.exe
3300	cmd.exe
636	cmd.exe
4972	cmd.exe
4676	cmd.exe
3176	cmd.exe
2736	cmd.exe
780	cmd.exe
4852	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	MärzwarePerm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	MärzwarePerm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	MärzwarePerm.exe
4624	MärzwarePerm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4376	WMIC.exe
Token: SeSecurityPrivilege	4376	WMIC.exe
Token: SeTakeOwnershipPrivilege	4376	WMIC.exe
Token: SeLoadDriverPrivilege	4376	WMIC.exe
Token: SeSystemProfilePrivilege	4376	WMIC.exe
Token: SeSystemtimePrivilege	4376	WMIC.exe
Token: SeProfSingleProcessPrivilege	4376	WMIC.exe
Token: SeIncBasePriorityPrivilege	4376	WMIC.exe
Token: SeCreatePagefilePrivilege	4376	WMIC.exe
Token: SeBackupPrivilege	4376	WMIC.exe
Token: SeRestorePrivilege	4376	WMIC.exe
Token: SeShutdownPrivilege	4376	WMIC.exe
Token: SeDebugPrivilege	4376	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4376	WMIC.exe
Token: SeRemoteShutdownPrivilege	4376	WMIC.exe
Token: SeUndockPrivilege	4376	WMIC.exe
Token: SeManageVolumePrivilege	4376	WMIC.exe
Token: 33	4376	WMIC.exe
Token: 34	4376	WMIC.exe
Token: 35	4376	WMIC.exe
Token: 36	4376	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4376	WMIC.exe
Token: SeSecurityPrivilege	4376	WMIC.exe
Token: SeTakeOwnershipPrivilege	4376	WMIC.exe
Token: SeLoadDriverPrivilege	4376	WMIC.exe
Token: SeSystemProfilePrivilege	4376	WMIC.exe
Token: SeSystemtimePrivilege	4376	WMIC.exe
Token: SeProfSingleProcessPrivilege	4376	WMIC.exe
Token: SeIncBasePriorityPrivilege	4376	WMIC.exe
Token: SeCreatePagefilePrivilege	4376	WMIC.exe
Token: SeBackupPrivilege	4376	WMIC.exe
Token: SeRestorePrivilege	4376	WMIC.exe
Token: SeShutdownPrivilege	4376	WMIC.exe
Token: SeDebugPrivilege	4376	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4376	WMIC.exe
Token: SeRemoteShutdownPrivilege	4376	WMIC.exe
Token: SeUndockPrivilege	4376	WMIC.exe
Token: SeManageVolumePrivilege	4376	WMIC.exe
Token: 33	4376	WMIC.exe
Token: 34	4376	WMIC.exe
Token: 35	4376	WMIC.exe
Token: 36	4376	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1092	WMIC.exe
Token: SeSecurityPrivilege	1092	WMIC.exe
Token: SeTakeOwnershipPrivilege	1092	WMIC.exe
Token: SeLoadDriverPrivilege	1092	WMIC.exe
Token: SeSystemProfilePrivilege	1092	WMIC.exe
Token: SeSystemtimePrivilege	1092	WMIC.exe
Token: SeProfSingleProcessPrivilege	1092	WMIC.exe
Token: SeIncBasePriorityPrivilege	1092	WMIC.exe
Token: SeCreatePagefilePrivilege	1092	WMIC.exe
Token: SeBackupPrivilege	1092	WMIC.exe
Token: SeRestorePrivilege	1092	WMIC.exe
Token: SeShutdownPrivilege	1092	WMIC.exe
Token: SeDebugPrivilege	1092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1092	WMIC.exe
Token: SeRemoteShutdownPrivilege	1092	WMIC.exe
Token: SeUndockPrivilege	1092	WMIC.exe
Token: SeManageVolumePrivilege	1092	WMIC.exe
Token: 33	1092	WMIC.exe
Token: 34	1092	WMIC.exe
Token: 35	1092	WMIC.exe
Token: 36	1092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1092	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4624	MärzwarePerm.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1216	4624	MärzwarePerm.exe	85
PID 1216 wrote to memory of 4376	1216	cmd.exe	86
PID 4624 wrote to memory of 4744	4624	MärzwarePerm.exe	88
PID 4744 wrote to memory of 1092	4744	cmd.exe	89
PID 4624 wrote to memory of 3960	4624	MärzwarePerm.exe	90
PID 3960 wrote to memory of 972	3960	cmd.exe	91
PID 4624 wrote to memory of 1548	4624	MärzwarePerm.exe	92
PID 1548 wrote to memory of 3348	1548	cmd.exe	93
PID 4624 wrote to memory of 3176	4624	MärzwarePerm.exe	94
PID 3176 wrote to memory of 1132	3176	cmd.exe	95
PID 4624 wrote to memory of 4632	4624	MärzwarePerm.exe	96
PID 4632 wrote to memory of 4856	4632	cmd.exe	97
PID 4624 wrote to memory of 3188	4624	MärzwarePerm.exe	98
PID 3188 wrote to memory of 4796	3188	cmd.exe	99
PID 4624 wrote to memory of 2736	4624	MärzwarePerm.exe	100
PID 2736 wrote to memory of 4644	2736	cmd.exe	101
PID 4624 wrote to memory of 3300	4624	MärzwarePerm.exe	102
PID 3300 wrote to memory of 4960	3300	cmd.exe	103
PID 4624 wrote to memory of 636	4624	MärzwarePerm.exe	104
PID 636 wrote to memory of 1240	636	cmd.exe	105
PID 4624 wrote to memory of 4972	4624	MärzwarePerm.exe	106
PID 4972 wrote to memory of 4756	4972	cmd.exe	107
PID 4624 wrote to memory of 780	4624	MärzwarePerm.exe	108
PID 780 wrote to memory of 4532	780	cmd.exe	109
PID 4624 wrote to memory of 3732	4624	MärzwarePerm.exe	110
PID 3732 wrote to memory of 4924	3732	cmd.exe	111
PID 4624 wrote to memory of 4676	4624	MärzwarePerm.exe	112
PID 4676 wrote to memory of 4412	4676	cmd.exe	113
PID 4624 wrote to memory of 204	4624	MärzwarePerm.exe	114
PID 204 wrote to memory of 1708	204	cmd.exe	115
PID 4624 wrote to memory of 4852	4624	MärzwarePerm.exe	116
PID 4852 wrote to memory of 2220	4852	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\MärzwarePerm.exe
"C:\Users\Admin\AppData\Local\Temp\MärzwarePerm.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get TotalPhysicalMemory
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber
    3⤵
    PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get SerialNumber
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get SystemType
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get SystemType
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Version
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Version
    3⤵
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get BuildNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get BuildNumber
    3⤵
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get Product
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get IdentifyingNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get IdentifyingNumber
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic get MACAddress
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic get MACAddress
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get Version
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Version
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber
    3⤵
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get ProcessorId
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads