Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
9Spoof Inst...ew.chm
windows7-x64
1Spoof Inst...ew.chm
windows10-2004-x64
1Spoof Inst...ew.exe
windows7-x64
6Spoof Inst...ew.exe
windows10-2004-x64
6Spoof Inst...pt.ps1
windows7-x64
3Spoof Inst...pt.ps1
windows10-2004-x64
3Spoof Inst...ID.cmd
windows7-x64
1Spoof Inst...ID.cmd
windows10-2004-x64
1Spoof Inst...id.exe
windows7-x64
3Spoof Inst...id.exe
windows10-2004-x64
3Spoof Inst...64.exe
windows7-x64
1Spoof Inst...64.exe
windows10-2004-x64
1Spoof Inst...me.bat
windows7-x64
3Spoof Inst...me.bat
windows10-2004-x64
7Spoof Inst...sk.exe
windows7-x64
5Spoof Inst...sk.exe
windows10-2004-x64
5Spoof Inst...ch.exe
windows7-x64
7Spoof Inst...ch.exe
windows10-2004-x64
7Spoof Inst...gs.vbs
windows7-x64
3Spoof Inst...gs.vbs
windows10-2004-x64
1Spoof Inst...ol.exe
windows7-x64
7Spoof Inst...ol.exe
windows10-2004-x64
7Spoof Inst...he.bat
windows7-x64
1Spoof Inst...he.bat
windows10-2004-x64
1Spoof Inst...or.url
windows7-x64
1Spoof Inst...or.url
windows10-2004-x64
1Spoof Inst...on.bat
windows7-x64
8Spoof Inst...on.bat
windows10-2004-x64
8Spoof Inst...er.exe
windows7-x64
6Spoof Inst...er.exe
windows10-2004-x64
6Spoof Inst...le.exe
windows7-x64
6Spoof Inst...le.exe
windows10-2004-x64
6Analysis
-
max time kernel
86s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 21:28
Behavioral task
behavioral1
Sample
Spoof Instructions/Spoof Toolz/OtherIDs/USBDeview.chm
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Spoof Instructions/Spoof Toolz/OtherIDs/USBDeview.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Spoof Instructions/Spoof Toolz/OtherIDs/USBDeview.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Spoof Instructions/Spoof Toolz/OtherIDs/USBDeview.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Spoof Instructions/Spoof Toolz/Reg_Script.ps1
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Spoof Instructions/Spoof Toolz/Reg_Script.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Spoof Instructions/Spoof Toolz/VolChange/ChangeVolID.cmd
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Spoof Instructions/Spoof Toolz/VolChange/ChangeVolID.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Spoof Instructions/Spoof Toolz/VolChange/_/Volumeid.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Spoof Instructions/Spoof Toolz/VolChange/_/Volumeid.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Spoof Instructions/Spoof Toolz/VolChange/_/Volumeid64.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Spoof Instructions/Spoof Toolz/VolChange/_/Volumeid64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Spoof Instructions/Toolz/Activate Win10Home.bat
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Spoof Instructions/Toolz/Activate Win10Home.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Spoof Instructions/Toolz/AnyDesk.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Spoof Instructions/Toolz/AnyDesk.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Spoof Instructions/Toolz/DNSBench.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Spoof Instructions/Toolz/DNSBench.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Spoof Instructions/Toolz/Defender Control/Defender_Settings.vbs
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Spoof Instructions/Toolz/Defender Control/Defender_Settings.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Spoof Instructions/Toolz/Defender Control/dControl.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Spoof Instructions/Toolz/Defender Control/dControl.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Spoof Instructions/Toolz/DelUSBCache.bat
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Spoof Instructions/Toolz/DelUSBCache.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Spoof Instructions/Toolz/Free Online GUID Generator.url
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
Spoof Instructions/Toolz/Free Online GUID Generator.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Spoof Instructions/Toolz/GeoLocation.bat
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Spoof Instructions/Toolz/GeoLocation.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Spoof Instructions/Toolz/PrivaZerPortable/App/PrivaZer/PrivaZer.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Spoof Instructions/Toolz/PrivaZerPortable/App/PrivaZer/PrivaZer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Spoof Instructions/Toolz/PrivaZerPortable/PrivaZerPortable.exe
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Spoof Instructions/Toolz/PrivaZerPortable/PrivaZerPortable.exe
Resource
win10v2004-20240802-en
General
-
Target
Spoof Instructions/Spoof Toolz/VolChange/ChangeVolID.cmd
-
Size
1KB
-
MD5
ca66f9da8e62ffee52071d1570bd2442
-
SHA1
0be16f861635f92d830b6546d299ba785ebbe9a7
-
SHA256
90f5849cac1ef0a43566b8533429c751045fe1ace4ee48f23be7094b9019de86
-
SHA512
5839d662153c3f6ac1278f168b885cd89715e526912abbc7925c204d0e92d308f5b7298e25a5669fb62f769e9bca759f926a02fd96b82de3510f22cac18b8b2f
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4988 1208 cmd.exe 84 PID 1208 wrote to memory of 4988 1208 cmd.exe 84