9f0930c6ccac8f9a6a58b056ce2cfa25da6a4c61ce6bdb31d80b963e911e0adf

Submit
Reports

Overview

overview

Static

static

CipherWare...29.rar

windows7-x64

CipherWare...29.rar

windows10-2004-x64

CipherWare...ns.txt

windows7-x64

CipherWare...ns.txt

windows10-2004-x64

CipherWare...ol.exe

windows7-x64

CipherWare...ol.exe

windows10-2004-x64

out.exe

windows7-x64

out.exe

windows10-2004-x64

CipherWare...gs.vbs

windows7-x64

CipherWare...gs.vbs

windows10-2004-x64

CipherWare...ol.ini

windows7-x64

CipherWare...ol.ini

windows10-2004-x64

CipherWare...me.url

windows7-x64

CipherWare...me.url

windows10-2004-x64

CipherWare.../1.png

windows7-x64

CipherWare.../1.png

windows10-2004-x64

CipherWare.../2.png

windows7-x64

CipherWare.../2.png

windows10-2004-x64

CipherWare.../3.png

windows7-x64

CipherWare.../3.png

windows10-2004-x64

CipherWare...ne.url

windows7-x64

CipherWare...ne.url

windows10-2004-x64

CipherWare...32.exe

windows7-x64

CipherWare...32.exe

windows10-2004-x64

CipherWare...64.exe

windows7-x64

CipherWare...64.exe

windows10-2004-x64

CipherWare...ub.ini

windows7-x64

CipherWare...ub.ini

windows10-2004-x64

CipherWare...er.exe

windows7-x64

CipherWare...er.exe

windows10-2004-x64

CipherWare...ss.exe

windows7-x64

CipherWare...ss.exe

windows10-2004-x64

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 11:21

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

3 signatures

Behavioral task

behavioral1

Sample

CipherWare Spoofer 04-29.rar

Resource

win7-20231129-en

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

CipherWare Spoofer 04-29.rar

Resource

win10v2004-20240426-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

CipherWare Spoofer 04-29/Instructions.txt

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

CipherWare Spoofer 04-29/Instructions.txt

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

CipherWare Spoofer 04-29/Requirements/Defender Control/Defender Control.exe

Resource

win7-20240215-en

upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral6

Sample

CipherWare Spoofer 04-29/Requirements/Defender Control/Defender Control.exe

Resource

win10v2004-20240508-en

upx

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral7

Sample

out.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

out.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

CipherWare Spoofer 04-29/Requirements/Defender Control/Defender_Settings.vbs

Resource

win7-20240220-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

CipherWare Spoofer 04-29/Requirements/Defender Control/Defender_Settings.vbs

Resource

win10v2004-20240426-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

CipherWare Spoofer 04-29/Requirements/Defender Control/dControl.ini

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

CipherWare Spoofer 04-29/Requirements/Defender Control/dControl.ini

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

CipherWare Spoofer 04-29/Requirements/DirectX End-User Runtime.url

Resource

win7-20240215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

CipherWare Spoofer 04-29/Requirements/DirectX End-User Runtime.url

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/1.png

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/1.png

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/2.png

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/2.png

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/3.png

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/3.png

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

CipherWare Spoofer 04-29/Requirements/Visual C++ Redistributable Runtimes All-in-One.url

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

CipherWare Spoofer 04-29/Requirements/Visual C++ Redistributable Runtimes All-in-One.url

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x32.exe

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x32.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x64.exe

Resource

win7-20240508-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Windows Update Blocker x64.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Wub.ini

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

CipherWare Spoofer 04-29/Requirements/Windows Update Blocker/Wub.ini

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

CipherWare Spoofer 04-29/Spoofer.exe

Resource

win7-20240215-en

agenttesla execution keylogger spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral30

Sample

CipherWare Spoofer 04-29/Spoofer.exe

Resource

win10v2004-20240508-en

agenttesla execution keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral31

Sample

CipherWare Spoofer 04-29/TPM Bypass.exe

Resource

win7-20240419-en

evasion execution trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral32

Sample

CipherWare Spoofer 04-29/TPM Bypass.exe

Resource

win10v2004-20240508-en

evasion execution trojan

windows10-2004-x64

23 signatures

150 seconds

Report Analysis Logs

General

Target

CipherWare Spoofer 04-29/Requirements/Disable IPv6 First/3.png
Size

51KB
MD5

f8d73f45036054f4d5e7d2cc4c16a51d
SHA1

a24840bef7e4dea01bf16dffea357adec7b65c20
SHA256

d4f4094b0b2e2a66f5d60b35b661986fe6a8954673edae0c8ecd2c4cae9006c7
SHA512

e97074c62fe53d35367183554bfdbfabaaecd70a2c814a87af4c5cff46b861fb5fab44a524c70054ccec98f3beeb8136e26d843957827e18272dc6775ce0645d
SSDEEP

768:IRuB90w/KZUmi3EKYDCNBLOBmU4b3HcBrFrMlUecF5xE7J5uDbVGpMX6R4osRfdQ:pNCZUTEBDUFb3HkMlSF/oJTZMbaL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CipherWare Spoofer 04-29\Requirements\Disable IPv6 First\3.png"
1⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4532,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads