Analysis
- user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 13:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MärzwarePerm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
MärzwarePerm.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target MärzwarePerm.exe
- Size 11.9MB
- Sample260912-qn2jpace53
- SHA256 83b92697e01a7e9bdd32c6b0b9a0926b669ff1c0c12ceb186a8c9a56b0c08236
- MD5 23af3de8b4fcc9080920163e5ded674c
- SHA1 581d41595a02787850eb47c5571ac74eb9581e00
- SHA512 326c8c399bfc0e38528c7f522717dd884eaf26a2bc8db08eff459f097521ad43173c9f0fd291bc1cc302b5b2637dac3196d4d7dcd5acc2186d7b8e70fb2e517b
- SSDEEP 196608:VT4qzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:lu+I3qspVAmsu2K
- TLSH T1B3C68D16A7AA49E1D0B3923489669667F3B2BC100FB4C7DF7298560E1F737E04D39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions MärzwarePerm.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools MärzwarePerm.exe - Executes a command shell one-liner 1 TTPs 16 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2596 cmd.exe 2396 cmd.exe 5360 cmd.exe 2080 cmd.exe 3108 cmd.exe 4176 cmd.exe 4272 cmd.exe 4788 cmd.exe 384 cmd.exe 4512 cmd.exe 6020 cmd.exe 2564 cmd.exe 2228 cmd.exe 1904 cmd.exe 3080 cmd.exe 2160 cmd.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS MärzwarePerm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor MärzwarePerm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2456 WMIC.exe 2456 WMIC.exe 2456 WMIC.exe 2456 WMIC.exe 2240 WMIC.exe 2240 WMIC.exe 2240 WMIC.exe 2240 WMIC.exe 4932 WMIC.exe 4932 WMIC.exe 4932 WMIC.exe 4932 WMIC.exe 6000 WMIC.exe 6000 WMIC.exe 6000 WMIC.exe 6000 WMIC.exe 3948 WMIC.exe 3948 WMIC.exe 3948 WMIC.exe 3948 WMIC.exe 4108 WMIC.exe 4108 WMIC.exe 4108 WMIC.exe 4108 WMIC.exe 2112 WMIC.exe 2112 WMIC.exe 2112 WMIC.exe 2112 WMIC.exe 5832 WMIC.exe 5832 WMIC.exe 5832 WMIC.exe 5832 WMIC.exe 120 WMIC.exe 120 WMIC.exe 120 WMIC.exe 120 WMIC.exe 1844 WMIC.exe 1844 WMIC.exe 1844 WMIC.exe 1844 WMIC.exe 1928 WMIC.exe 1928 WMIC.exe 1928 WMIC.exe 1928 WMIC.exe 5140 WMIC.exe 5140 WMIC.exe 5140 WMIC.exe 5140 WMIC.exe 3480 WMIC.exe 3480 WMIC.exe 3480 WMIC.exe 3480 WMIC.exe 5256 WMIC.exe 5256 WMIC.exe 5256 WMIC.exe 5256 WMIC.exe 3412 WMIC.exe 3412 WMIC.exe 3412 WMIC.exe 3412 WMIC.exe 5384 WMIC.exe 5384 WMIC.exe 5384 WMIC.exe 5384 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2456 WMIC.exe Token: SeSecurityPrivilege 2456 WMIC.exe Token: SeTakeOwnershipPrivilege 2456 WMIC.exe Token: SeLoadDriverPrivilege 2456 WMIC.exe Token: SeSystemProfilePrivilege 2456 WMIC.exe Token: SeSystemtimePrivilege 2456 WMIC.exe Token: SeProfSingleProcessPrivilege 2456 WMIC.exe Token: SeIncBasePriorityPrivilege 2456 WMIC.exe Token: SeCreatePagefilePrivilege 2456 WMIC.exe Token: SeBackupPrivilege 2456 WMIC.exe Token: SeRestorePrivilege 2456 WMIC.exe Token: SeShutdownPrivilege 2456 WMIC.exe Token: SeDebugPrivilege 2456 WMIC.exe Token: SeSystemEnvironmentPrivilege 2456 WMIC.exe Token: SeRemoteShutdownPrivilege 2456 WMIC.exe Token: SeUndockPrivilege 2456 WMIC.exe Token: SeManageVolumePrivilege 2456 WMIC.exe Token: 33 2456 WMIC.exe Token: 34 2456 WMIC.exe Token: 35 2456 WMIC.exe Token: 36 2456 WMIC.exe Token: SeIncreaseQuotaPrivilege 2456 WMIC.exe Token: SeSecurityPrivilege 2456 WMIC.exe Token: SeTakeOwnershipPrivilege 2456 WMIC.exe Token: SeLoadDriverPrivilege 2456 WMIC.exe Token: SeSystemProfilePrivilege 2456 WMIC.exe Token: SeSystemtimePrivilege 2456 WMIC.exe Token: SeProfSingleProcessPrivilege 2456 WMIC.exe Token: SeIncBasePriorityPrivilege 2456 WMIC.exe Token: SeCreatePagefilePrivilege 2456 WMIC.exe Token: SeBackupPrivilege 2456 WMIC.exe Token: SeRestorePrivilege 2456 WMIC.exe Token: SeShutdownPrivilege 2456 WMIC.exe Token: SeDebugPrivilege 2456 WMIC.exe Token: SeSystemEnvironmentPrivilege 2456 WMIC.exe Token: SeRemoteShutdownPrivilege 2456 WMIC.exe Token: SeUndockPrivilege 2456 WMIC.exe Token: SeManageVolumePrivilege 2456 WMIC.exe Token: 33 2456 WMIC.exe Token: 34 2456 WMIC.exe Token: 35 2456 WMIC.exe Token: 36 2456 WMIC.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe Token: SeSecurityPrivilege 2240 WMIC.exe Token: SeTakeOwnershipPrivilege 2240 WMIC.exe Token: SeLoadDriverPrivilege 2240 WMIC.exe Token: SeSystemProfilePrivilege 2240 WMIC.exe Token: SeSystemtimePrivilege 2240 WMIC.exe Token: SeProfSingleProcessPrivilege 2240 WMIC.exe Token: SeIncBasePriorityPrivilege 2240 WMIC.exe Token: SeCreatePagefilePrivilege 2240 WMIC.exe Token: SeBackupPrivilege 2240 WMIC.exe Token: SeRestorePrivilege 2240 WMIC.exe Token: SeShutdownPrivilege 2240 WMIC.exe Token: SeDebugPrivilege 2240 WMIC.exe Token: SeSystemEnvironmentPrivilege 2240 WMIC.exe Token: SeRemoteShutdownPrivilege 2240 WMIC.exe Token: SeUndockPrivilege 2240 WMIC.exe Token: SeManageVolumePrivilege 2240 WMIC.exe Token: 33 2240 WMIC.exe Token: 34 2240 WMIC.exe Token: 35 2240 WMIC.exe Token: 36 2240 WMIC.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1576 MärzwarePerm.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1576 wrote to memory of 4272 1576 MärzwarePerm.exe 86 PID 4272 wrote to memory of 2456 4272 cmd.exe 87 PID 1576 wrote to memory of 2080 1576 MärzwarePerm.exe 89 PID 2080 wrote to memory of 2240 2080 cmd.exe 90 PID 1576 wrote to memory of 2564 1576 MärzwarePerm.exe 91 PID 2564 wrote to memory of 4932 2564 cmd.exe 92 PID 1576 wrote to memory of 2160 1576 MärzwarePerm.exe 93 PID 2160 wrote to memory of 6000 2160 cmd.exe 94 PID 1576 wrote to memory of 3108 1576 MärzwarePerm.exe 95 PID 3108 wrote to memory of 3948 3108 cmd.exe 96 PID 1576 wrote to memory of 4788 1576 MärzwarePerm.exe 97 PID 4788 wrote to memory of 4108 4788 cmd.exe 98 PID 1576 wrote to memory of 2228 1576 MärzwarePerm.exe 99 PID 2228 wrote to memory of 2112 2228 cmd.exe 100 PID 1576 wrote to memory of 384 1576 MärzwarePerm.exe 101 PID 384 wrote to memory of 5832 384 cmd.exe 102 PID 1576 wrote to memory of 4176 1576 MärzwarePerm.exe 103 PID 4176 wrote to memory of 120 4176 cmd.exe 104 PID 1576 wrote to memory of 1904 1576 MärzwarePerm.exe 105 PID 1904 wrote to memory of 1844 1904 cmd.exe 106 PID 1576 wrote to memory of 2596 1576 MärzwarePerm.exe 107 PID 2596 wrote to memory of 1928 2596 cmd.exe 108 PID 1576 wrote to memory of 3080 1576 MärzwarePerm.exe 109 PID 3080 wrote to memory of 5140 3080 cmd.exe 110 PID 1576 wrote to memory of 2396 1576 MärzwarePerm.exe 111 PID 2396 wrote to memory of 3480 2396 cmd.exe 112 PID 1576 wrote to memory of 4512 1576 MärzwarePerm.exe 113 PID 4512 wrote to memory of 5256 4512 cmd.exe 114 PID 1576 wrote to memory of 5360 1576 MärzwarePerm.exe 115 PID 5360 wrote to memory of 3412 5360 cmd.exe 116 PID 1576 wrote to memory of 6020 1576 MärzwarePerm.exe 117 PID 6020 wrote to memory of 5384 6020 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\MärzwarePerm.exe"C:\Users\Admin\AppData\Local\Temp\MärzwarePerm.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic computersystem get Name2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Name3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get Name2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get Name3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic computersystem get TotalPhysicalMemory2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get TotalPhysicalMemory3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic bios get SerialNumber2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get SerialNumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get SerialNumber2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\System32\Wbem\WMIC.exewmic os get SerialNumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic computersystem get SystemType2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get SystemType3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get Version2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\System32\Wbem\WMIC.exewmic os get Version3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get BuildNumber2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\System32\Wbem\WMIC.exewmic os get BuildNumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get Product2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get Product3⤵
- Suspicious behavior: EnumeratesProcesses
PID:120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get SerialNumber2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get SerialNumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get IdentifyingNumber2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get IdentifyingNumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic get MACAddress2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\System32\Wbem\WMIC.exewmic nic get MACAddress3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic bios get Version2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get Version3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get uuid2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get SerialNumber2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get SerialNumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get ProcessorId2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get ProcessorId3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5384
-
-