Overview
overview
10Static
static
93ntr_Perm/...er.exe
windows10-2004-x64
83ntr_Perm/...er.exe
windows11-ltsc_2024-x64
83ntr_Perm/...er.exe
windows10-2004-x64
103ntr_Perm/...er.exe
windows11-ltsc_2024-x64
103ntr_Perm/...er.exe
windows10-2004-x64
13ntr_Perm/...er.exe
windows11-ltsc_2024-x64
83ntr_Perm/...10.exe
windows10-2004-x64
13ntr_Perm/...10.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
900s - max time network
667s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 15:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3ntr_Perm/#2cleaner.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
3ntr_Perm/#2cleaner.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
900 seconds
Behavioral task
behavioral3
Sample
3ntr_Perm/Perm Spoofer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral4
Sample
3ntr_Perm/Perm Spoofer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
900 seconds
Behavioral task
behavioral5
Sample
3ntr_Perm/perm spoofer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
3ntr_Perm/perm spoofer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral7
Sample
3ntr_Perm/perm spoofer_v10.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
3ntr_Perm/perm spoofer_v10.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target 3ntr_Perm/Perm Spoofer.exe
- Size 7.1MB
- Sample260913-sd7ztsycjf
- SHA256 edb665b5abbcba04ead33e62a5cdf9775f676741aebf212428ad7b51a157eafd
- MD5 20abdd54c5388ca67f816b289ae0fa61
- SHA1 cb4a6c01b02e1cfd5b12b5ebca0520391f0f5cc2
- SHA512 5982c781dbd1d2c7c26436b2c6be8af24cc4f663d56bf4f55cf40ae685bc1c7985eaf309ce2d3fe9a873c61e48e91879626403087a9827f765ab8417aabc68a1
- SSDEEP 98304:IqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBxS:IqHhAk1f/FI//E4WSpQ79nBxS
- TLSH T1E776AD16B3A0C0B9C4668538C9A6C7F6E771BC14972097CB22E47E5B7F336D06A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral4/files/0x000d00000001c607-8.dat Nirsoft - Executes dropped EXE 6 IoCs
pid Process 4324 perm spoofer.exe 5956 icsys.icn.exe 1864 explorer.exe 4052 spoolsv.exe 1304 svchost.exe 3336 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification C:\Windows\Resources\Themes\tjcm.cmn explorer.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe Perm Spoofer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Perm Spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 5956 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1864 explorer.exe 1304 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4444 Perm Spoofer.exe 4444 Perm Spoofer.exe 5956 icsys.icn.exe 5956 icsys.icn.exe 1864 explorer.exe 1864 explorer.exe 4052 spoolsv.exe 4052 spoolsv.exe 1304 svchost.exe 1304 svchost.exe 3336 spoolsv.exe 3336 spoolsv.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4444 wrote to memory of 4324 4444 Perm Spoofer.exe 87 PID 4444 wrote to memory of 5956 4444 Perm Spoofer.exe 88 PID 5956 wrote to memory of 1864 5956 icsys.icn.exe 89 PID 1864 wrote to memory of 4052 1864 explorer.exe 90 PID 4052 wrote to memory of 1304 4052 spoolsv.exe 91 PID 1304 wrote to memory of 3336 1304 svchost.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\Perm Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\Perm Spoofer.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\users\admin\appdata\local\temp\3ntr_perm\perm spoofer.exe"c:\users\admin\appdata\local\temp\3ntr_perm\perm spoofer.exe "2⤵
- Executes dropped EXE
PID:4324
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3336
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4004
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:2860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\3ntr_Perm\perm spoofer.exe
- Size 7.0MB
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
- MD5 4f40c7ebb4914f9bce64ef75da7dfe44
- SHA1 d8a116160944f06aa025e770b1653faa6ca86911
- SHA512 5bd5867d59d73ec12e2cc2a2fba4f6ab4ece70f7b33b54570485888114c29b000a5f7e1f85695843bce262cfb67504684899a77b507f15fbf01a7573a9cc6692
- SSDEEP 98304:JqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBx:JqHhAk1f/FI//E4WSpQ79nBx
- TLSH T16776AD56B3A4C0B9C4668538C9A6C7F6E771BC04972097CB22E47E5B7F336D02A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 a4a7a5f44e2fd3fea0dc351bf24480fee909df1a21b7c7436bfaa352a30e6043
- MD5 b741dd29147beb8f4f166d1956577ebb
- SHA1 f7f9b8ed88ab14b6b24b7c510288242b2133bfbc
- SHA512 8f32a1bea909f5bcb550ae7a39c4862ce61d85a4187f7f9964066cae65d93900133746fa5d06d86ce50eeb704d67eb37bfc1107a5bf7e1e1e8edfbd889b53545
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU6f:UVqoCl/YgjxEufVU0TbTyDDal26f
- TLSH T1A5D3F713BE14452ED83286F268B5DA6E79215F361BD17E0732A6BB0837B2147B5F021F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 90b1bd8545baa81dd0b7b8ac03635e765dac41f9215b09d0698bc5efaa9877d5
- MD5 378f447e12e97eeecfc8efc99dc2cca0
- SHA1 eb150e2487a8cb7a60cbfc77cb37f9dff512ee03
- SHA512 9782f50995f40186e06ab38ebce28de54d99ff539bfdc7032a58b461257815005ac08aba61affc5894723ba3ccdb6d04ecec14e67fadd895a78518ef5b86dd32
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU6i:UVqoCl/YgjxEufVU0TbTyDDal26i
- TLSH T1AAD319337F20541FD85688F12899E66AFA328F761FA16C0777A2B701297A143B1F520F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 aa8127941237a0ed7b712a710fdf1dfcf82e94cf580c2d0a09414424a1b82ed4
- MD5 b9e8af05e99b7ce9ac0d2de0c8379b8e
- SHA1 41daf87a03a4c32b60343e8910284ec301618fc2
- SHA512 1668d4433ea86e2fcd5699bd6f34509248c2e09eca8c66251a966936d225b7d58904a35f14132ceaed6168304afdd06101a3ca33415438b7a043ce4e22814dc6
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU65:UVqoCl/YgjxEufVU0TbTyDDal265
- TLSH T1C5D30B13BE14682EE915C9F138A5D97DB9326E362FD06D4BB296FB0035B1203B6F411B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 ae430224b91fe9ae5969e32036d51d9885af7935afe2c80c341d1562f691c592
- MD5 f8e5f289e30d14ddf85a775b59be5547
- SHA1 9475156895a8a0996e77c543e5e80e9ec55a84dc
- SHA512 d39eaa38cd98e1c3f27c244fa635e3e18655dada9d5fc25f67ac43b1c8aea096d857c5d2036628c40acbefffb0275832abb2b24f5f510462382336640a29c4f8
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVU6v:UVqoCl/YgjxEufVU0TbTyDDal26v
- TLSH T1C2D30923AF10406ED951C9F16CA4A66EBA121F3E0BE4AD1723A7BB1175F114776F021F
- MD5 SHA1 SHA512 SSDEEP TLSH