Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7Spoofer.exe
windows10-2004-x64
10cleaners/a...er.exe
windows10-2004-x64
9cleaners/cleaner.bat
windows10-2004-x64
10spoofers/C...32.exe
windows10-2004-x64
1spoofers/C...64.exe
windows10-2004-x64
1spoofers/C...64.sys
windows10-2004-x64
1spoofers/g...64.sys
windows10-2004-x64
1spoofers/s...er.bat
windows10-2004-x64
1Resubmissions
10/07/2024, 02:30 UTC
240710-czl2gstcke 1020/06/2024, 12:39 UTC
240620-pvzs1axflf 1020/06/2024, 12:36 UTC
240620-pswcss1hrr 720/06/2024, 12:35 UTC
240620-psqgjs1hrm 1020/06/2024, 12:33 UTC
240620-prd25axdpg 10Analysis
-
max time kernel
454s -
max time network
1176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 12:33 UTC
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
cleaners/applecleaner.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
cleaners/cleaner.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
spoofers/CupFixerx32.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
spoofers/CupFixerx64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
spoofers/CupFixerx64.sys
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
spoofers/gsoftgmx64.sys
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
spoofers/serial_checker.bat
Resource
win10v2004-20240611-en
General
-
Target
spoofers/CupFixerx64.exe
-
Size
377KB
-
MD5
b4eceb90668db85712e66fd493ce4ca5
-
SHA1
951f3e9503b9b31a0c944355870dbfea0df32441
-
SHA256
bf8df68bbac80b4382206917b9bb46e8fd6cf76f6acd7374a3e6f5470681597c
-
SHA512
b912554fd863b237edd9f6518676ca9a190b7c7dc54024973a6062da8bf5ce8c6ad16219032cb0ed1ade7d2b5a855a6dc2aeb71c0ddde476a8bec64068ba0284
-
SSDEEP
6144:4NFU+vVycygjjsp5dcAONdA22xVK8LRPo4WBIeX+oD9/nwLk9C9I6i:4bygjjsrdcAONdA22xVK8LRPo4WGkD9Q
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found
Processes
Network
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.173.189.20.in-addr.arpaIN PTRResponse
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
23.159.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.236.111.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
9.173.189.20.in-addr.arpa