Overview
overview
9Static
static
7CupFixer R...i..rar
windows7-x64
3CupFixer R...i..rar
windows10-2004-x64
3Spoofer/C+...ll.bat
windows7-x64
7Spoofer/C+...ll.bat
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
4Spoofer/C+...64.exe
windows10-2004-x64
4Spoofer/C+...86.exe
windows7-x64
4Spoofer/C+...86.exe
windows10-2004-x64
4Spoofer/CupFixer.exe
windows7-x64
9Spoofer/CupFixer.exe
windows10-2004-x64
9Spoofer/Mac.exe
windows7-x64
9Spoofer/Mac.exe
windows10-2004-x64
9Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 21:24
Behavioral task
behavioral1
Sample
CupFixer Replica by .type_shi..rar
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
CupFixer Replica by .type_shi..rar
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
Spoofer/C++/install_all.bat
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Spoofer/C++/install_all.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Spoofer/C++/vcredist2005_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Spoofer/C++/vcredist2005_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Spoofer/C++/vcredist2005_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Spoofer/C++/vcredist2005_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Spoofer/C++/vcredist2008_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Spoofer/C++/vcredist2008_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Spoofer/C++/vcredist2008_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Spoofer/C++/vcredist2008_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Spoofer/C++/vcredist2010_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Spoofer/C++/vcredist2010_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Spoofer/C++/vcredist2010_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Spoofer/C++/vcredist2010_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Spoofer/C++/vcredist2012_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Spoofer/C++/vcredist2012_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Spoofer/C++/vcredist2012_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Spoofer/C++/vcredist2012_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Spoofer/C++/vcredist2013_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Spoofer/C++/vcredist2013_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Spoofer/C++/vcredist2013_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
Spoofer/C++/vcredist2013_x86.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x86.exe
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Spoofer/CupFixer.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
Spoofer/CupFixer.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
Spoofer/Mac.exe
Resource
win7-20240704-en
General
-
Target
Spoofer/Mac.exe
-
Size
2.8MB
-
MD5
968ba4b5549e08605049d5d126406c5a
-
SHA1
b6204e980656a3465be1a93e274ef9e263cef189
-
SHA256
ad1e8e8f42d7db9753ec0faaff70224866140845ef775fbd97a5246e7e64f902
-
SHA512
c27851a92ff09e278ed74b38cbe31b6b8b472a287981860767ebd4b4ae212b80cb82a0f97e7397d436913153b163710241151bdb789d7c0e49c8a287ac3baa0c
-
SSDEEP
49152:7ACyWLMURxAxsjSmlFHQyeN27hvIP2BJD0mfsmBrOHG9vCPdk0BjTEqAh:7OyRx95FHNeNKVHJ4mf1q+Ik0VTpG
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Mac.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Mac.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Mac.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Mac.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Mac.exe -
Processes:
resource yara_rule behavioral32/memory/1400-0-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida behavioral32/memory/1400-3-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida behavioral32/memory/1400-4-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida behavioral32/memory/1400-2-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida behavioral32/memory/1400-5-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida behavioral32/memory/1400-6-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida behavioral32/memory/1400-7-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida behavioral32/memory/1400-16-0x00007FF60C190000-0x00007FF60C87F000-memory.dmp themida -
Processes:
Mac.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Mac.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Mac.exepid process 1400 Mac.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Mac.execmd.exedescription pid process target process PID 1400 wrote to memory of 4948 1400 Mac.exe cmd.exe PID 1400 wrote to memory of 4948 1400 Mac.exe cmd.exe PID 1400 wrote to memory of 1068 1400 Mac.exe cmd.exe PID 1400 wrote to memory of 1068 1400 Mac.exe cmd.exe PID 1068 wrote to memory of 3384 1068 cmd.exe certutil.exe PID 1068 wrote to memory of 3384 1068 cmd.exe certutil.exe PID 1068 wrote to memory of 3000 1068 cmd.exe find.exe PID 1068 wrote to memory of 3000 1068 cmd.exe find.exe PID 1068 wrote to memory of 4940 1068 cmd.exe find.exe PID 1068 wrote to memory of 4940 1068 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoofer\Mac.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer\Mac.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Spoofer\Mac.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Spoofer\Mac.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-0-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB
-
memory/1400-1-0x00007FFCD5790000-0x00007FFCD5792000-memory.dmpFilesize
8KB
-
memory/1400-3-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB
-
memory/1400-4-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB
-
memory/1400-2-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB
-
memory/1400-5-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB
-
memory/1400-6-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB
-
memory/1400-7-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB
-
memory/1400-16-0x00007FF60C190000-0x00007FF60C87F000-memory.dmpFilesize
6.9MB