hxxps://github[.]com/Scrut1ny/Windows-Spoofer

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2025, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Scrut1ny/Windows-Spoofer

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
37	camo.githubusercontent.com
38	camo.githubusercontent.com
39	camo.githubusercontent.com
40	camo.githubusercontent.com
33	camo.githubusercontent.com
34	camo.githubusercontent.com
35	camo.githubusercontent.com
36	camo.githubusercontent.com

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
35	6040	msedge.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_948590366\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_948590366\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_948590366\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_948590366\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_411207120\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_411207120\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_411207120\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_948590366\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_411207120\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5140_411207120\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133888956487805842"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2645532622-3298555945-705856666-1000\{8561FC43-DC04-4181-B0A7-1046E04C4371}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3412	OpenWith.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4460	AMIDEWINx64.EXE
3128	DMIEDIT.EXE
4056	DMIEDIT.EXE
5244	AMIDEWINx64.EXE
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe
3412	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5140 wrote to memory of 6068	5140	msedge.exe	83
PID 5140 wrote to memory of 6068	5140	msedge.exe	83
PID 5140 wrote to memory of 6040	5140	msedge.exe	84
PID 5140 wrote to memory of 6040	5140	msedge.exe	84
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 6088	5140	msedge.exe	85
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86
PID 5140 wrote to memory of 5492	5140	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Scrut1ny/Windows-Spoofer
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x324,0x7ff84434f208,0x7ff84434f214,0x7ff84434f220
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1752,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2300,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2476,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3492,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5072,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5064,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6252,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6180,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5944,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5988,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5264,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6848,i,2976763238583732351,13542999155597296888,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4856

C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\AMIDEWINx64.EXE
"C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\AMIDEWINx64.EXE"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4460

C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\DMIEDIT.EXE
"C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\DMIEDIT.EXE"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\DMIEDIT.EXE
"C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\DMIEDIT.EXE"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\AMIDEWINx64.EXE
"C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\GRINX64v2\AMIDEWINx64.EXE"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Windows-Spoofer-main\Windows-Spoofer-main\README.md
  2⤵
  PID:5524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5140_411207120\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5140_411207120\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cf3da7267cb6a35a74a4dceb3097a615

SHA1
a1b06c52d03147a6adbad9d32436b3b497115584

SHA256
18a6d652dd17544c9feb2e01621ed64b958b1a26bcee81e29ab29d5a409dc222

SHA512
6238eb406a42dfdf3faf7b62c92c6c0993974617f2ff403f6cd0a23dd2d53893bd96e92e78bbe6ba35ff191cdbcb8ecd69318c76547df76341ce9f2d43aae71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
a26f5fded6cbb634eb484f9f8f7db880

SHA1
d50fb35fef137bc979fd4ac5284a6d5efee66f5f

SHA256
7ad174caa0c54542b39e9362eefc20dee87a143256f0745ff84904331ddf4019

SHA512
3b68ebc42c457bd628864f55f39c2bd1e224c22686addbbcc3d83a305ea5c5b3f844624f9c24ff827148c3db456f9396124ac81521d946b2dc5476554dd84ded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57f9e1.TMP

Filesize
4KB

MD5
a24d59596d92a398d04c672f7ea6fc14

SHA1
21ba7e075977a77ed3f1ecbc2aa7d447920e4013

SHA256
7f16384beb9f5bb211923b41dd012e20d06129ee96cbc617a24dd7194d14bf73

SHA512
ef2e3eeeb7b1948d42acbedfa3cc36ab2ab8db32d512bcdf8cbf48a6299750905db009482778becb075ba132a0835556ad3629d80fe0fede3fb31de9f94978a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2dc274d760f02914c30caae3d309405e

SHA1
b684f11d1253bb63542995f903cd68f4a0545857

SHA256
9463c6064e45ad296981d5112db3eb6cf8b1b76de8747d44c84b2145a6d63a95

SHA512
b426cc5ce0e2ceb689e0b2cb77a37f4af53305b51d44e9c774c359cb3cc00efd482cb06ca5d47bc9db4e25eb1392537730ca81dca10b53a427031b5f8bd6aee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
616222c81ba1e017fccfb6b51f0b80b7

SHA1
ddc77db29e3d06195b50540cacb7ed10638d177d

SHA256
a80e5eabfbac54ccce09c064f96d1851c3310eca3de1141005e5b4bdbc349ab5

SHA512
acebed947ca5da3bf0a8f1d6065a48f03abebfcd2bdc6452bb32483612a3437f210166895cab7178aebff81078a15c74dfabe78d85df7014774cccb52f9f99ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
4d0cb10f9b5943fe69ea72ddad9ab4fe

SHA1
1ad344f1ba604fbad90d130c6e27bcf539f19fa9

SHA256
3cf580fcc919b0948383a4f41ac387dd4a1983d2789ec3603401b93069e0713d

SHA512
42ab9586ea3457ebc14d5496daede16bc6befc39f10f724a78b14e722e00a656f453edc1b6c9a838151fab982fcb3a2dcb502f89f7f874f37f4a82fd57588487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
e60c15a80173fdf3f5019b3e7f0d0948

SHA1
94c0a9c5008b212528dea5637ce9d27fa56057c9

SHA256
52eefe1c0f55efe68fd0e1d9004ded0c2d95833029474fc0663874fe48b28251

SHA512
af7dcfea04d7ae0df55ba0df25f5b50f0b5d661dcdcc1774337b5bad158dc16b2707d05543b9dcd048bc9b774dee6008329c34018f5b11e2cc6b5d6ab41e0c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
a876d3023bec54fb56142862a2cee571

SHA1
743a989ff7ef3a189d2cab74cfba6b9e2503b9fc

SHA256
efaa1fdfff319395c64775347d5b85c5a898173f50295ee4e367dd26ccd19a63

SHA512
4bb2e2769e667417333b6c128919063f3505176e1c35bda2a7b37a1b1ca0c1f36c416328fb1acc8b30b4b1c6ddead60519ffab7a90e8d7a6a90c2da9c991bdb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
ad84f8f27f6a147e26b5f61d248fe856

SHA1
376b53c8531669d47fb3fb474292cb82a892a47e

SHA256
e3129579f7cfba2faafde0a990043477b70ce52400375bbd2fb12001cd7a0034

SHA512
33c69c5982cc9936f536e5d74de4707309538b24a32280dba3cf43af43d88bff7cf7cb3f85ce84d5395de5cafc2351688f8c3cfc694ca5dd50721ad6d3ec9a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
9a463a97dedcaa5061fa1de13bbff763

SHA1
a8e6ba82aaee5400da638540dfb8b12115d5d17d

SHA256
843dd0e83ed0d10d5b76c858884eb0fa81fffd91939c47ff86e21e2e152b7c73

SHA512
304c22edf0eaa4949a8c78a210b79e3f4d2f9f58c952a7b7fb2dd8d4c9f5c15c05684e645420099359f10f9e3c18d71509c91909ac97df0e030d2f5f3657c02e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
29556c104cb65d0843f2a3d6e088df94

SHA1
f829019e351e1dbfa3b7b50077e7cc65c355fd88

SHA256
645fbd1dae27bb81a8b5be84af7429e322cad84a1189c11cf6658e25ac7647af

SHA512
e7c1c8e153890822178c49a34ac9b0464d23e0f418c79b74074f897a45c0904f0572d28b8ec178041d0728b13439862a9a090f5a2910fb2dbc18c50d97c3593c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
dac7d5694ea360695956f553efcf7093

SHA1
47a126ada66b81109ed1aab6653250a4707267b1

SHA256
adda00b47a606018ecd66713e2b2ba4ecdfc6b90eef289b96653150517866df8

SHA512
6662d415cb89c90691672f53efcc9ca7eca2bf7cceb92018dd204836b8dc386a9484907abc97a2eb2f94891ec5a32ef0247c06e4bc862e8a122c2f938269c4b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
45KB

MD5
599c9157e1f354acce0046ecd0f4a284

SHA1
71fec8f7a032a3fb82a79deb4e312e596b6d0734

SHA256
b0e0b1d07ace3ff77df13ab9175b9347a270454d11f18eda47802711d01605aa

SHA512
88bfbccefa191ea41b8c330e599eb3a2f981316f8c35e0f4e3760a8c4735cd3e75a0119bb838265aa1ec75cb12c3b8ed83d73d4a44c4424eddd0f330e77fc459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
0ec91d03226789fa250b5693233ab4b7

SHA1
fb80f2d3db96d03819243f2936798de0ca724624

SHA256
30126e3d818ce2a2827472bc44e103d5f24f1f0133889232db95ae740c681a76

SHA512
8608f3cab2a08fc9a33bacbd3deba3298fdd73908191a1c6b0f36ee38597005712cb4c81208ed3af074b09f206bdf9e00b1ef1aa9eea7b61a6d5aac608b7767f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
caec095fab1dd2cdf1d8f1f6ce31db9c

SHA1
d52eff385cd75c23aa86cc2dd0686f1395ff734a

SHA256
ad50adf50ca8360d99fb422bb265ff439fc3a9215e2b6f70a73253000d8ca156

SHA512
3e58a5c504a7d4aeba8eb7906fac6ad2b0b15870446f9f5067354bfbded4ef6c536f0753a27da0322c5b6183708a8338f67b402377083e42e00b899372e8ab77

Download Submit
C:\Users\Admin\Downloads\Windows-Spoofer-main.zip.crdownload

Filesize
1.7MB

MD5
38505cc92d32c147184f94673597c74f

SHA1
5f7985de4bfacf55c2003454ee6e94d90d13ce4b

SHA256
28702a16414d4ed87c9127f7d966c4d6245719b99f7c2b9d0478bc935898463a

SHA512
545aec4086774fcd14759385c9ab9e5425538bf6c82f8d35891a605ef8be425a8b5c3e60251cb4c854ac6dfb73e670c198cdc32d607ad451922cb73e6f1a81df

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads