2deae5346696feed6b2cce57eb002e5fac09734e8a0e888cba0935d00d50036e | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 14:38

Sharing

Report Analysis Logs

General

Target

PRODUCT Panty Poof/SPOOFER LOADER.exe
Size

895KB
MD5

512a21a95db27f67bbf385b4b68f6aa8
SHA1

c5ab6cced5b8f146f3a0296532e59d0c5a3ae0ea
SHA256

ac6ee3886816b257e372a5b7b54ff006c2125f523b04e75d8c531b0a8c81c81d
SHA512

f4b45aee392d373abd026462bafdad38a37300c8db52d707f572b3fff8ee8a140c6fe514fc55d5257e9d225d1e29b57adc55b9f5408743e25d620c32512e9c07
SSDEEP

24576:mrovWp6faeGgjjsrdcAONdA22xVK8LRPo4WDD9/wr9WTEHd3:FvWECQn/m

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\amigendrv64.sys	SPOOFER LOADER.exe
File created	C:\Windows\System32\AppVDll.exe	SPOOFER LOADER.exe
File created	C:\Windows\System32\accessibility.dll	SPOOFER LOADER.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\VPO.exe	SPOOFER LOADER.exe
File created	C:\Windows\apppatch\Custom\e.bat	SPOOFER LOADER.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3040	2976	SPOOFER LOADER.exe	29
PID 2976 wrote to memory of 3040	2976	SPOOFER LOADER.exe	29
PID 2976 wrote to memory of 3040	2976	SPOOFER LOADER.exe	29
PID 2976 wrote to memory of 2972	2976	SPOOFER LOADER.exe	30
PID 2976 wrote to memory of 2972	2976	SPOOFER LOADER.exe	30
PID 2976 wrote to memory of 2972	2976	SPOOFER LOADER.exe	30

C:\Users\Admin\AppData\Local\Temp\PRODUCT Panty Poof\SPOOFER LOADER.exe
"C:\Users\Admin\AppData\Local\Temp\PRODUCT Panty Poof\SPOOFER LOADER.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color F1
  2⤵
  PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads