Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...up.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...up.exe
windows10-2004-x64
1Analysis
-
max time kernel
30s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2022, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
moonspoofer-main/moonspoofer/bin/Debug/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
moonspoofer-main/moonspoofer/bin/Debug/app.publish/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
moonspoofer-main/moonspoofer/bin/Release/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
moonspoofer-main/moonspoofer/bin/Release/app.publish/Application Files/MoonSpoofer_1_0_0_26/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
moonspoofer-main/moonspoofer/bin/Release/app.publish/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral6
Sample
moonspoofer-main/moonspoofer/bin/Release/app.publish/setup.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
moonspoofer-main/moonspoofer/obj/Debug/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
moonspoofer-main/moonspoofer/obj/Release/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/Loader_1_0_0_0/Loader.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral10
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/Loader_1_0_0_1/Loader.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/Loader_1_0_0_2/Loader.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral12
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_21/Nowy folder/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_22/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral14
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_23/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_24/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral16
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_25/MoonSpoofer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_26/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral18
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_11/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_12/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral20
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_12/halo/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_15/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral22
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_16/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_16/UranSpoofer_Secure/UranSpoofer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral24
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_17/Confused/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_18/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral26
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_19/UranSpoofer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_19/UranSpoofer_Secure/Protected/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral28
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_19/UranSpoofer_Secure/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_6/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral30
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_7/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_8/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral32
Sample
moonspoofer-main/moonspoofer/publikuj/setup.exe
Resource
win10v2004-20221111-en
General
-
Target
moonspoofer-main/moonspoofer/publikuj/Application Files/Loader_1_0_0_0/Loader.exe
-
Size
285KB
-
MD5
a930794fe6221e6a00dd569ed61ad462
-
SHA1
5bc4311cf8471989bbe3155f3f42b9ab34fa6f2b
-
SHA256
21b3b70d6466aec112d593be2d45b9956534b4f82e3a6d7204bc2c0caa304cd9
-
SHA512
c01601c31046087c30ed602b04e47a63414ec6e26eae6852f2e2c66c368a5b4347dd89d3ed5a98831aa6f854a1fc3cd61d0d5c7c8f0315dbcc403903523a9899
-
SSDEEP
6144:IiiRQEbZf1AKU/MgltzPVVlm6LVUkfRh0LFqinHZ8f4BnacolJ3tTT:IiiRQX/VvDV7mYVfRh0c0HjFgJ3tX
Malware Config
Signatures
-
Delays execution with timeout.exe 1 IoCs
pid Process 1176 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3368 Loader.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3368 wrote to memory of 3200 3368 Loader.exe 84 PID 3368 wrote to memory of 3200 3368 Loader.exe 84 PID 3368 wrote to memory of 3200 3368 Loader.exe 84 PID 3200 wrote to memory of 3664 3200 cmd.exe 86 PID 3200 wrote to memory of 3664 3200 cmd.exe 86 PID 3200 wrote to memory of 3664 3200 cmd.exe 86 PID 3664 wrote to memory of 1176 3664 cmd.exe 88 PID 3664 wrote to memory of 1176 3664 cmd.exe 88 PID 3664 wrote to memory of 1176 3664 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\publikuj\Application Files\Loader_1_0_0_0\Loader.exe"C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\publikuj\Application Files\Loader_1_0_0_0\Loader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start cmd /C "color b && title Error && echo Application not found && timeout /t 5"2⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.execmd /C "color b && title Error && echo Application not found && timeout /t 5"3⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:1176
-
-
-