64686f15b7c40ef6ac16bcbf421fa65c91c5a386b95c4d15a84a7b914f590dae

Analysis

user interaction
yes
max time kernel
68s
max time network
74s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ventura Free Spoofer 1.0.exe
Size 40KB
Sample260703-wsf2faaw6p
SHA256 64686f15b7c40ef6ac16bcbf421fa65c91c5a386b95c4d15a84a7b914f590dae
MD5 f0331ebe930051ce85ba300d6754ddbb
SHA1 f560e797f3e090d71f7180dff857ae872be15361
SHA512 30b111f70eed4732fbe5f0078ab00ff2f8d8c94dfad6fd55fd757cd4c59c447ebf4be75b36242e0bfa36a8f6858019c0fc8b1c108a3d2c035869bb784f950679
SSDEEP 768:QQeDx0YS20lckpyrEayRfYP4qVbel82Hbk5hL0tHK5E2HwM:QQ6x0YS20lcOyrEayR4FeqZL0tHNM
TLSH
T17C034C0B675544FCD1DBD1B8CA872A16D33AB846036296CF13D092B62FD63D0AE3EE51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	sihost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 5016	5728	Ventura Free Spoofer 1.0.exe	89
PID 5016 wrote to memory of 5152	5016	cmd.exe	90
PID 5728 wrote to memory of 1588	5728	Ventura Free Spoofer 1.0.exe	91
PID 5728 wrote to memory of 1724	5728	Ventura Free Spoofer 1.0.exe	93
PID 5728 wrote to memory of 5336	5728	Ventura Free Spoofer 1.0.exe	94
PID 5728 wrote to memory of 4488	5728	Ventura Free Spoofer 1.0.exe	95
PID 2188 wrote to memory of 3736	2188	sihost.exe	100

C:\Users\Admin\AppData\Local\Temp\Ventura Free Spoofer 1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Ventura Free Spoofer 1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=80 lines=30
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\mode.com
    mode con cols=80 lines=30
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4488

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:3736

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3312

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5884-51-0x000001F983B90000-0x000001F983BB0000-memory.dmp

Download

memory/5884-37-0x000001F983930000-0x000001F983950000-memory.dmp

Download

memory/5884-38-0x000001F993D90000-0x000001F993E90000-memory.dmp

Download

memory/5884-66-0x000001F9945A0000-0x000001F9945C0000-memory.dmp

Download

memory/5884-22-0x000001F9801E0000-0x000001F9802E0000-memory.dmp

Download

memory/5884-21-0x000001F9801E0000-0x000001F9802E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads