Overview
overview
10Static
static
93ntr_Perm/...er.exe
windows10-2004-x64
83ntr_Perm/...er.exe
windows11-ltsc_2024-x64
83ntr_Perm/...er.exe
windows10-2004-x64
103ntr_Perm/...er.exe
windows11-ltsc_2024-x64
103ntr_Perm/...er.exe
windows10-2004-x64
13ntr_Perm/...er.exe
windows11-ltsc_2024-x64
83ntr_Perm/...10.exe
windows10-2004-x64
13ntr_Perm/...10.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
900s - max time network
666s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 15:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3ntr_Perm/#2cleaner.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
3ntr_Perm/#2cleaner.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
900 seconds
Behavioral task
behavioral3
Sample
3ntr_Perm/Perm Spoofer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral4
Sample
3ntr_Perm/Perm Spoofer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
900 seconds
Behavioral task
behavioral5
Sample
3ntr_Perm/perm spoofer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
3ntr_Perm/perm spoofer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral7
Sample
3ntr_Perm/perm spoofer_v10.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
3ntr_Perm/perm spoofer_v10.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target 3ntr_Perm/Perm Spoofer.exe
- Size 7.1MB
- Sample260913-sd7ztsycjf
- SHA256 edb665b5abbcba04ead33e62a5cdf9775f676741aebf212428ad7b51a157eafd
- MD5 20abdd54c5388ca67f816b289ae0fa61
- SHA1 cb4a6c01b02e1cfd5b12b5ebca0520391f0f5cc2
- SHA512 5982c781dbd1d2c7c26436b2c6be8af24cc4f663d56bf4f55cf40ae685bc1c7985eaf309ce2d3fe9a873c61e48e91879626403087a9827f765ab8417aabc68a1
- SSDEEP 98304:IqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBxS:IqHhAk1f/FI//E4WSpQ79nBxS
- TLSH T1E776AD16B3A0C0B9C4668538C9A6C7F6E771BC14972097CB22E47E5B7F336D06A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral3/files/0x00080000000242f1-8.dat Nirsoft - Executes dropped EXE 6 IoCs
pid Process 4136 perm spoofer.exe 3748 icsys.icn.exe 2804 explorer.exe 2776 spoolsv.exe 1264 svchost.exe 2084 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification C:\Windows\Resources\Themes\tjcm.cmn explorer.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe Perm Spoofer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Perm Spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 3748 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2804 explorer.exe 1264 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2404 Perm Spoofer.exe 2404 Perm Spoofer.exe 3748 icsys.icn.exe 3748 icsys.icn.exe 2804 explorer.exe 2804 explorer.exe 2776 spoolsv.exe 2776 spoolsv.exe 1264 svchost.exe 1264 svchost.exe 2084 spoolsv.exe 2084 spoolsv.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2404 wrote to memory of 4136 2404 Perm Spoofer.exe 86 PID 2404 wrote to memory of 3748 2404 Perm Spoofer.exe 87 PID 3748 wrote to memory of 2804 3748 icsys.icn.exe 88 PID 2804 wrote to memory of 2776 2804 explorer.exe 89 PID 2776 wrote to memory of 1264 2776 spoolsv.exe 90 PID 1264 wrote to memory of 2084 1264 svchost.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\Perm Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\Perm Spoofer.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\users\admin\appdata\local\temp\3ntr_perm\perm spoofer.exe"c:\users\admin\appdata\local\temp\3ntr_perm\perm spoofer.exe "2⤵
- Executes dropped EXE
PID:4136
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2084
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 7ec567dfd73692f888032dd8766e80840ac1d951950c5f65972790c49f7c4817
- MD5 fc3a3668ddd5bbc8c9b0f4d39277d39f
- SHA1 5ef1ea26ca81e601005792cb30e2053430fffd06
- SHA512 370508fcf4fab2d6794dfa4ad00f2eaaeb3535fff538d18ccf97b2568a6eac5a48b56f5ed410408fb28f14c80edffc1e52a05ce39be5d2b120e70483b6308c7e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU62:UVqoCl/YgjxEufVU0TbTyDDal262
- TLSH T18FD309237E40502FE82185F058A9FA5EB5661F3A0FE5AD077776BB412AB620375F021F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 90b1bd8545baa81dd0b7b8ac03635e765dac41f9215b09d0698bc5efaa9877d5
- MD5 378f447e12e97eeecfc8efc99dc2cca0
- SHA1 eb150e2487a8cb7a60cbfc77cb37f9dff512ee03
- SHA512 9782f50995f40186e06ab38ebce28de54d99ff539bfdc7032a58b461257815005ac08aba61affc5894723ba3ccdb6d04ecec14e67fadd895a78518ef5b86dd32
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU6i:UVqoCl/YgjxEufVU0TbTyDDal26i
- TLSH T1AAD319337F20541FD85688F12899E66AFA328F761FA16C0777A2B701297A143B1F520F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 e7660d3a28df8f449fde35eb15fc119ec87f98f1137ba79efca140f509ae7ad4
- MD5 23719ac9040c5a42e1940b9b6f4fbdf9
- SHA1 59e9fa1aaffc574e6a8d5c9ff933646cff7cd9d7
- SHA512 82b2ab5fc61b559d21cb8c8cdc4e3496889d236ac926c373e6a2aed6166b496713f17240721e555b1a92f46f9b9a81300b4af420c9c581ffed47f3df1dcad29e
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU6k:UVqoCl/YgjxEufVU0TbTyDDal26k
- TLSH T17BD31C27BE90613FD81189F168E6EF5EB9115F2A1BE4AD073366B7102971603B6F120F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\3ntr_perm\perm spoofer.exe
- Size 7.0MB
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
- MD5 4f40c7ebb4914f9bce64ef75da7dfe44
- SHA1 d8a116160944f06aa025e770b1653faa6ca86911
- SHA512 5bd5867d59d73ec12e2cc2a2fba4f6ab4ece70f7b33b54570485888114c29b000a5f7e1f85695843bce262cfb67504684899a77b507f15fbf01a7573a9cc6692
- SSDEEP 98304:JqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBx:JqHhAk1f/FI//E4WSpQ79nBx
- TLSH T16776AD56B3A4C0B9C4668538C9A6C7F6E771BC04972097CB22E47E5B7F336D02A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\resources\svchost.exe
- Size 135KB
- SHA256 c88caf4e0c63a3108c914d4b112b240d9e916079979b0ff336b6a570ae00e663
- MD5 039cddf1f8fb15a724dbdb1c5f91820c
- SHA1 61035168b166494333764da40c29b764455cb4ea
- SHA512 eee8712dc68d20d363daeea4e9970d7fb8dd3f75323e64a2159334f384226094b6a38bae4f20a140cde1867c16960eb248f3c2cdfdfb278baf4b48029d5a286c
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU6a:UVqoCl/YgjxEufVU0TbTyDDal26a
- TLSH T191D32A237E10106FD4218EF128AAEA6AF9239E3A1BD56D077366BB04357654371F430F
- MD5 SHA1 SHA512 SSDEEP TLSH