Analysis
- user interaction
yes - max time kernel
14s - max time network
3s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/07/2026, 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FiveM Spoofer.exe
Resource
win11-20260513-en
4 signatures
150 seconds
General
- Target FiveM Spoofer.exe
- Size 3.6MB
- Sample260715-lrcbracv4x
- SHA256 3d7bcc3b7cb1faf1354c0c5e927c1db64e2e34ebc226c30ac10e34babafd6a8f
- MD5 f9e3e9031691fa01aae08f8178b82460
- SHA1 54b4bccf5b5448cbd5a6128eb99475060a630e56
- SHA512 654774a3adac2b83ee71985350d11fa8fa20e8684cb9b5446e2873cc51667dce29d9a660c439e2dc01e1ea3570113761b49d3d981efb7545e4f19a150f031144
- SSDEEP 49152:/opD4YS7JslWdyIaZUngVga0lOgdJWihLNKVG+FzovGYkuG:/oXwDLN0ovGYku
- TLSH T11A069D2433AB2810C972EC3898AEE7EE82D2AD604B57C7CF654561AC1A338F55777D43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3384 FiveM Spoofer.exe 3384 FiveM Spoofer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2980 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FiveM Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\FiveM Spoofer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3384
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2980
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
- Size 22KB
- SHA256 0e798bf483c11301bb376fcf5f4ab7f26b60819dc4786067d2a9004a46df9581
- MD5 685f6a20e2fdaf575dc70665b9546d29
- SHA1 8b717d10035c79f35fc64e0bfa4e5a6f872766b8
- SHA512 ddab76b440ae99d55775e72ea86ae579c2533d1d5773f3eedc51c329a4df11b8da26c4cf7680826d77e3f4e9b54939c815f3e613513eff169b5e907ed6b4e2f0
- SSDEEP 384:4JWJRVca12krtuVm+3glBOVjeQ8RJo1gtghcjUudW05P4m5b+GDa50DKaYAV6cqQ:0+RVcWr8l8RJqsg2jUuddhb+GDa50DKg
- TLSH T1F7A24C743AF51719F3F29F749AF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
- MD5 SHA1 SHA512 SSDEEP TLSH