Overview
overview
8Static
static
3VixenFreePerm.zip
windows10-2004-x64
1VixenFreePerm.zip
windows11-ltsc_2024-x64
1RUN AS ADM...OF.bat
windows10-2004-x64
7RUN AS ADM...OF.bat
windows11-ltsc_2024-x64
7deps/AMIDEWINx64.exe
windows10-2004-x64
1deps/AMIDEWINx64.exe
windows11-ltsc_2024-x64
1deps/AMIFLDRV64.sys
windows10-2004-x64
3deps/AMIFLDRV64.sys
windows11-ltsc_2024-x64
3deps/EEUPDATE.exe
windows10-2004-x64
1deps/EEUPDATE.exe
windows11-ltsc_2024-x64
1deps/PSWOA.exe
windows10-2004-x64
7deps/PSWOA.exe
windows11-ltsc_2024-x64
7deps/RTIoLib64.dll
windows10-2004-x64
1deps/RTIoLib64.dll
windows11-ltsc_2024-x64
1deps/RTNicPgW64.exe
windows10-2004-x64
1deps/RTNicPgW64.exe
windows11-ltsc_2024-x64
1deps/amigendrv64.sys
windows10-2004-x64
3deps/i3782.bat
windows10-2004-x64
8deps/i3782.bat
windows11-ltsc_2024-x64
8deps/iqvsw64e.cat
windows10-2004-x64
1deps/iqvsw64e.cat
windows11-ltsc_2024-x64
8deps/iqvsw64e.inf
windows10-2004-x64
1deps/iqvsw64e.inf
windows11-ltsc_2024-x64
1deps/iqvsw64e.sys
windows10-2004-x64
3deps/rtkio64.sys
windows10-2004-x64
3deps/rtkio64.sys
windows11-ltsc_2024-x64
3deps/rtkiow10x64.sys
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
VixenFreePerm.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
VixenFreePerm.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
RUN AS ADMIN TO SPOOF.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
RUN AS ADMIN TO SPOOF.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
deps/AMIDEWINx64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
deps/AMIDEWINx64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
deps/AMIFLDRV64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
deps/AMIFLDRV64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
deps/EEUPDATE.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
deps/EEUPDATE.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
deps/PSWOA.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
deps/PSWOA.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
deps/RTIoLib64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
deps/RTIoLib64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
deps/RTNicPgW64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
deps/RTNicPgW64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
deps/amigendrv64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
deps/i3782.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
deps/i3782.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
deps/iqvsw64e.cat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
deps/iqvsw64e.cat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
deps/iqvsw64e.inf
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
deps/iqvsw64e.inf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
deps/iqvsw64e.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
deps/rtkio64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
deps/rtkio64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
deps/rtkiow10x64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target RUN AS ADMIN TO SPOOF.bat
- Size 318B
- Sample261027-bcllrszzby
- SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
- MD5 60972c42004f8c1fb66bfdc828d061cd
- SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
- SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
- TLSH T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe - Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4336 sc.exe 3500 sc.exe 3792 sc.exe 4888 sc.exe 1300 sc.exe - Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1468 cmd.exe 884 cmd.exe 2268 cmd.exe 4152 cmd.exe 3260 cmd.exe 1672 cmd.exe 988 cmd.exe 2732 cmd.exe 536 cmd.exe 4396 cmd.exe 3748 cmd.exe 3780 cmd.exe 1148 cmd.exe 3400 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Kills process with taskkill 4 IoCs
pid Process 1756 taskkill.exe 4708 taskkill.exe 1768 taskkill.exe 4748 taskkill.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2} WmiPrvSE.exe - Runs net.exe
- Suspicious behavior: LoadsDriver 6 IoCs
pid Process 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1768 taskkill.exe Token: SeDebugPrivilege 4748 taskkill.exe Token: SeDebugPrivilege 1756 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 212 svchost.exe Token: SeIncreaseQuotaPrivilege 212 svchost.exe Token: SeSecurityPrivilege 212 svchost.exe Token: SeTakeOwnershipPrivilege 212 svchost.exe Token: SeLoadDriverPrivilege 212 svchost.exe Token: SeSystemtimePrivilege 212 svchost.exe Token: SeBackupPrivilege 212 svchost.exe Token: SeRestorePrivilege 212 svchost.exe Token: SeShutdownPrivilege 212 svchost.exe Token: SeSystemEnvironmentPrivilege 212 svchost.exe Token: SeUndockPrivilege 212 svchost.exe Token: SeManageVolumePrivilege 212 svchost.exe Token: SeAssignPrimaryTokenPrivilege 212 svchost.exe Token: SeIncreaseQuotaPrivilege 212 svchost.exe Token: SeSecurityPrivilege 212 svchost.exe Token: SeTakeOwnershipPrivilege 212 svchost.exe Token: SeLoadDriverPrivilege 212 svchost.exe Token: SeSystemtimePrivilege 212 svchost.exe Token: SeBackupPrivilege 212 svchost.exe Token: SeRestorePrivilege 212 svchost.exe Token: SeShutdownPrivilege 212 svchost.exe Token: SeSystemEnvironmentPrivilege 212 svchost.exe Token: SeUndockPrivilege 212 svchost.exe Token: SeManageVolumePrivilege 212 svchost.exe Token: SeAssignPrimaryTokenPrivilege 212 svchost.exe Token: SeIncreaseQuotaPrivilege 212 svchost.exe Token: SeSecurityPrivilege 212 svchost.exe Token: SeTakeOwnershipPrivilege 212 svchost.exe Token: SeLoadDriverPrivilege 212 svchost.exe Token: SeSystemtimePrivilege 212 svchost.exe Token: SeBackupPrivilege 212 svchost.exe Token: SeRestorePrivilege 212 svchost.exe Token: SeShutdownPrivilege 212 svchost.exe Token: SeSystemEnvironmentPrivilege 212 svchost.exe Token: SeUndockPrivilege 212 svchost.exe Token: SeManageVolumePrivilege 212 svchost.exe Token: SeAssignPrimaryTokenPrivilege 212 svchost.exe Token: SeIncreaseQuotaPrivilege 212 svchost.exe Token: SeSecurityPrivilege 212 svchost.exe Token: SeTakeOwnershipPrivilege 212 svchost.exe Token: SeLoadDriverPrivilege 212 svchost.exe Token: SeSystemtimePrivilege 212 svchost.exe Token: SeBackupPrivilege 212 svchost.exe Token: SeRestorePrivilege 212 svchost.exe Token: SeShutdownPrivilege 212 svchost.exe Token: SeSystemEnvironmentPrivilege 212 svchost.exe Token: SeUndockPrivilege 212 svchost.exe Token: SeManageVolumePrivilege 212 svchost.exe Token: SeAssignPrimaryTokenPrivilege 212 svchost.exe Token: SeIncreaseQuotaPrivilege 212 svchost.exe Token: SeSecurityPrivilege 212 svchost.exe Token: SeTakeOwnershipPrivilege 212 svchost.exe Token: SeLoadDriverPrivilege 212 svchost.exe Token: SeSystemtimePrivilege 212 svchost.exe Token: SeBackupPrivilege 212 svchost.exe Token: SeRestorePrivilege 212 svchost.exe Token: SeShutdownPrivilege 212 svchost.exe Token: SeSystemEnvironmentPrivilege 212 svchost.exe Token: SeUndockPrivilege 212 svchost.exe Token: SeManageVolumePrivilege 212 svchost.exe Token: SeAssignPrimaryTokenPrivilege 212 svchost.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1468 wrote to memory of 4424 1468 cmd.exe 86 PID 4424 wrote to memory of 536 4424 PSWOA.exe 87 PID 536 wrote to memory of 1768 536 cmd.exe 88 PID 4424 wrote to memory of 884 4424 PSWOA.exe 90 PID 884 wrote to memory of 4336 884 cmd.exe 91 PID 4424 wrote to memory of 2268 4424 PSWOA.exe 92 PID 2268 wrote to memory of 4644 2268 cmd.exe 93 PID 4644 wrote to memory of 3716 4644 net.exe 94 PID 4424 wrote to memory of 4152 4424 PSWOA.exe 97 PID 4152 wrote to memory of 4748 4152 cmd.exe 98 PID 4424 wrote to memory of 4396 4424 PSWOA.exe 99 PID 4424 wrote to memory of 3260 4424 PSWOA.exe 100 PID 3260 wrote to memory of 1728 3260 cmd.exe 101 PID 4424 wrote to memory of 1672 4424 PSWOA.exe 102 PID 1672 wrote to memory of 3500 1672 cmd.exe 103 PID 4424 wrote to memory of 3748 4424 PSWOA.exe 104 PID 3748 wrote to memory of 3792 3748 cmd.exe 105 PID 4424 wrote to memory of 988 4424 PSWOA.exe 107 PID 988 wrote to memory of 4888 988 cmd.exe 108 PID 4424 wrote to memory of 2732 4424 PSWOA.exe 109 PID 2732 wrote to memory of 1756 2732 cmd.exe 110 PID 4424 wrote to memory of 3780 4424 PSWOA.exe 114 PID 3780 wrote to memory of 1300 3780 cmd.exe 115 PID 4424 wrote to memory of 1148 4424 PSWOA.exe 117 PID 1148 wrote to memory of 4708 1148 cmd.exe 118 PID 4424 wrote to memory of 3400 4424 PSWOA.exe 119 PID 3400 wrote to memory of 4640 3400 cmd.exe 120 PID 4424 wrote to memory of 4684 4424 PSWOA.exe 122 PID 4424 wrote to memory of 4160 4424 PSWOA.exe 124 PID 4424 wrote to memory of 1752 4424 PSWOA.exe 127 PID 4424 wrote to memory of 632 4424 PSWOA.exe 130 PID 4424 wrote to memory of 2160 4424 PSWOA.exe 132 PID 4424 wrote to memory of 2616 4424 PSWOA.exe 134
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN AS ADMIN TO SPOOF.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\deps\PSWOA.exePSWOA.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\system32\sc.exesc config winmgmt start=disabled4⤵
- Launches sc.exe
PID:4336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\net.exenet stop winmgmt /y4⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y5⤵PID:3716
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem3⤵
- Executes a command shell one-liner
PID:4396
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\System32\Wbem\WmiPrvSE.exewmiprvse /regserver4⤵
- Modifies registry class
PID:1728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\system32\sc.exesc config winmgmt start= auto4⤵
- Launches sc.exe
PID:3500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:3792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\system32\sc.exesc stop winmgmt4⤵
- Launches sc.exe
PID:4888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\system32\sc.exesc start winmgmt4⤵
- Launches sc.exe
PID:1300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\system32\taskkill.exetaskkill /im wmi* /f /t4⤵
- Kills process with taskkill
PID:4708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get cat4⤵
- Reads the TCP/IP host and domain name from the registry
PID:4640
-
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /BM3⤵PID:4684
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /SS3⤵PID:4160
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /BS3⤵PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /CS3⤵PID:632
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /PSN3⤵PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\deps\amidewinx64.exeamidewinx64.exe /PPN3⤵PID:2616
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:4828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:212
-
C:\Users\Admin\AppData\Local\Temp\deps\amigendrv64.sysC:\Users\Admin\AppData\Local\Temp\deps\amigendrv64.sys1⤵PID:4076