Analysis
- user interaction
yes - max time kernel
899s - max time network
474s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
14/10/2026, 23:14
Behavioral task
behavioral1
Sample
SetX PERM .exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
19 signatures
900 seconds
Behavioral task
behavioral2
Sample
SetX PERM .exe
Resource
win11-20260911-en
windows11-21h2-x64
20 signatures
900 seconds
General
- Target SetX PERM .exe
- Size 7.1MB
- Sample261014-276tastxes
- SHA256 690c07374157f639bb5ce829feddc41067f425219e159db17f8cae31fdeb57a9
- MD5 fee694e5638e711c68a1aa66eaa3393e
- SHA1 27a92ec46e3da2132e17bf6baa2963c741ff66c9
- SHA512 905aefe81cc889ff1c7a8384429f7d29dfe5b5ce721f738d91c8026c681c362d3adfea38a6de02e09367771dda9e3e6485820cbbe1b90ae7f540061eff138df1
- SSDEEP 196608:X7L/ZLKKpUdqfnsQILptioY2YdgGjg4OOtBm6vCQi2RKPCsQ:XJLZpUEfhIVtitdgGjg4OOtvv5HsQ
- TLSH T1A376338CD5B3D137E02F05B79E2962717CD57AA036C8938C19B30D13E5839BF6A8A5B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SetX PERM .exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1632 powershell.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SetX PERM .exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SetX PERM .exe - Executes dropped EXE 3 IoCs
pid Process 4432 AMIDEWINx64.EXE 4792 amifldrv64.sys 3168 AMIDEWINx64.EXE -
resource yara_rule behavioral1/memory/3568-8-0x0000000140000000-0x00000001412A6000-memory.dmp themida behavioral1/memory/3568-9-0x0000000140000000-0x00000001412A6000-memory.dmp themida behavioral1/memory/3568-129-0x0000000140000000-0x00000001412A6000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SetX PERM .exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
pid Process 3568 SetX PERM .exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SetX PERM .exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SetX PERM .exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion SetX PERM .exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SetX PERM .exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SetX PERM .exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 powershell.exe 1632 powershell.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3812 taskmgr.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 688 Process not Found 688 Process not Found - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1632 powershell.exe Token: SeDebugPrivilege 3812 taskmgr.exe Token: SeSystemProfilePrivilege 3812 taskmgr.exe Token: SeCreateGlobalPrivilege 3812 taskmgr.exe Token: 33 3812 taskmgr.exe Token: SeIncBasePriorityPrivilege 3812 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe 3812 taskmgr.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3568 wrote to memory of 1632 3568 SetX PERM .exe 92 PID 3568 wrote to memory of 4432 3568 SetX PERM .exe 94 PID 3568 wrote to memory of 3168 3568 SetX PERM .exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetX PERM .exe"C:\Users\Admin\AppData\Local\Temp\SetX PERM .exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-TpmAutoProvisioning; Clear-Host; Clear-Tpm"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\AMId22171577274485397996d7d022c3ce8\AMIDEWINx64.EXE"C:\Users\Admin\AppData\Local\Temp\AMId22171577274485397996d7d022c3ce8\AMIDEWINx64.EXE" /BS "210991240130741"2⤵
- Executes dropped EXE
PID:4432
-
-
C:\Users\Admin\AppData\Local\Temp\AMId22171577274485397996d7d022c3ce8\AMIDEWINx64.EXE"C:\Users\Admin\AppData\Local\Temp\AMId22171577274485397996d7d022c3ce8\AMIDEWINx64.EXE" /BS "210991240130741"2⤵
- Executes dropped EXE
PID:3168
-
-
C:\Users\Admin\AppData\Local\Temp\AMId22171577274485397996d7d022c3ce8\amifldrv64.sysC:\Users\Admin\AppData\Local\Temp\AMId22171577274485397996d7d022c3ce8\amifldrv64.sys1⤵
- Executes dropped EXE
PID:4792
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3812
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5096
-
C:\Windows\System32\_d6tju.exe"C:\Windows\System32\_d6tju.exe"1⤵PID:2672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\SetX Spoofer\Tools\EFI\AMIDEWINx64.EXE.tmp
- Size 453KB
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\SetX Spoofer\Tools\EFI\AMIFLDRV64.SYS.tmp
- Size 18KB
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3xnqduuy.uuz.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH